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FOREWORD 


The purpose of this manual is to encourage the uniform application of the Standards and Recommended Practices 
contained in Annex 13 and to provide information and guidance to States on the procedures, practices and techniques 
that can be used in aircraft accident investigations. Since accident investigations vary in complexity, a document of this 
kind cannot cover all eventualities. The more common techniques and processes, however, have been included. 
Although this manual will be of use to experienced and inexperienced investigators alike, it is not a substitute for 
investigation training and experience. 


This manual will be issued in four separate parts as follows: 
Part | — Organization and Planning; 
Part Il — Procedures and Checklists; 
Part Ill — Investigation; 
Part IV — Reporting. 


Because this manual deals with both accident and incident investigations and, for reasons of brevity, the term “accident 
investigation”, as used herein, applies equally to “incident investigation”. 


The following ICAO documents provide additional information and guidance material on related subjects: 


— Annex 6 — Operation of Aircraft 
(Part | — International Commercial Air Transport — Aeroplanes, 
Part Il — International General Aviation — Aeroplanes, 
Part IIl — International Operations — Helicopters); 
— Annex 9 — Facilitation; 
— Annex 12 — Search and Rescue; 
— Annex 13 — Aircraft Accident and Incident Investigation; 
— Manual of Civil Aviation Medicine (Doc 8984); 
— Human Factors Training Manual (Doc 9683); 
— Safety Management Manual (Doc 9859); 
— Manual on Accident and Incident Investigation Policies and Procedures (Doc 9946); 
— Human Factors Digest No. 7 — Investigation of Human Factors in Accidents and Incidents (Cir 240); 
— Guidance on Assistance to Aircraft Accident Victims and their Families (Cir 285); 
— Training Guidelines for Aircraft Accident Investigators (Cir 298); and 
— Hazards at Aircraft Accident Sites (Cir 315). 


This manual, which supersedes Doc 6920 in its entirety, will be amended periodically as new investigation techniques 
are developed and new information becomes available. 


Ill-(v) 


Iil-(vi) Manual of Aircraft Accident and Incident Investigation 





Readers are invited to submit material for possible inclusion in subsequent editions of this manual. This material should 
be addressed to: 


The Secretary General 

International Civil Aviation Organization 
999 University Street 

Montréal, Quebec 

Canada H3C 5H7 
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Chapter 1 


INTRODUCTION 


1.1. INVESTIGATION PROCESS 


1.1.1 Accident investigation is a systematic process whereby all of the possible causes of an adverse event are 
evaluated and eliminated until the remaining causes are identified as applicable to that investigation. Furthermore, 
during the investigation, if other deficiencies are identified that were not part of this accident, the investigation team 
should note them and provide this information to the applicable authority, even though it may not become part of the 
Official investigation report. Although many accidents appear to be similar to others, this may be misleading. Therefore, it 
is imperative that investigators keep an open mind so as not to focus on one aspect and thus overlook another. Because 
accidents are infrequent, investigators must take every opportunity to obtain training with air carriers, military, aircraft 
manufacturers and other accident investigators so as to retain currency and acquire the best methods for investigation. 
Many large air carriers and aircraft manufacturers have established accident investigation resources that should be 
consulted in support of periodic training. Air carriers and aerodromes conduct periodic emergency exercises, and these 
also provide an opportunity for the accident investigators to utilize these scenarios for training. In the event of an actual 
accident or serious incident, these relationships will be useful to the investigators in efficiently determining the causes. 


1.1.2 Investigation of accidents consists of three phases (see Figure III-1-1): 
a) collection of data; 
b) analysis of data; and 


Cc) presentation of findings. 








Collection of data f-—»| Analysisofdata =») Presentation of findings 


























Figure Ill-1-1. Investigation process 


1.2 COLLECTION OF DATA 
1.2.1 The initial phase of the investigation process should focus on defining and obtaining data relevant to the 
accident. In particular, highly perishable data should be given priority. Data collection will often develop into an on-going 
process as more is learned about events surrounding the accident. Therefore, data collected early in the investigation 
may be combined with other data collected at later stages as a method of reaffirming and validating possible contributing 
factors. Types of data to be collected include: 


a) accident particulars; 


b) meteorological; 
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c) technical; and 


d) human factors. 


Collection of accident particulars 
1.2.2 Important reference data must be collected to facilitate collection of meteorological, aircraft performance 
and air traffic control data. Primary sources of such data shall be obtained from flight plans, Air Traffic Services (ATS) 
radar data, navigation and topographical charts. Data collected should include: 
a) date (UTC and LMT); 
b) time (UTC and LMT); 
c) location; 
1) general location; 
2) grid reference; and 
3) elevation and topography; 
d) departure point; 
e) cruising altitude or flight level; and 


f) destination and intermediate stops (with ETAs and ETDs), and radar tracks. 


Collection of meteorological particulars 


1.2.3 The forecast and local weather conditions may have significant importance on both the flight conditions 
and the aircraft performance. This will include the atmospheric conditions, sun or moon locations, wind and any unusual 
considerations such as volcanic ash, smoke, windshear, visual illusions or icing, along with take-off or destination 
considerations that may have impacted the take-off or landing profile, such as rushed departure or additional fuel 
reserve due to expected delays or diversions. 


Collection of technical particulars 


1.2.4 This data is provided from the investigation at the accident or incident site along with maintenance and 
manufacturing records, onboard data collection devices and laboratory analysis of aircraft components. This information 
may also provide a course for synthetic flight reconstruction and simulation. Other related indicators may be uncovered 
from maintenance reports and review of similar incidents from accident and incident databases. 


Collection of human factors particulars 
1.2.5 Human factors information is sometimes the most difficult in fatal accidents because there are few 


witnesses to interview to confirm what actions and conditions the flight crew were experiencing. Interviews with 
maintenance and co-workers can be very emotional and challenging. The results of autopsies and reconstruction of 


Part Ill. Investigation 
Chapter 1. Introduction Ill-1-3 





crew actions from cockpit voice recordings and air traffic control tapes may provide indicators to flight crew actions. 
Systems failures may also require interviews with maintenance and ground service personnel. These interviews should 
be conducted as soon as possible while their knowledge remains clear and is uncontaminated by conversations with 
other workers. 


1.3 DATA ANALYSIS 


Data analysis is conducted in parallel with data collection. Often the analysis of data initiates additional questions that 
require further data collection, simulation and consultation. Seldom do the results of an analysis show an isolated cause 
with a specific resolution. Regular discussions between the various investigation team members is necessary so as to 
collect and process all the necessary data. 


1.4 PRESENTATION OF FINDINGS 


Accident reports should be provided in the format identified in ICAO Annex 13 for inclusion in the ADREP database. 
Often the findings of incident investigations can be more useful and provide greater safety benefits than those of 
accident investigations. 


Chapter 2 


WRECKAGE INVESTIGATION 


2.1 ACCIDENT LOCATION 


2.1.1 The location of the accident site must be determined and recorded. It is important to identify the point of 
impact and, if not at the same location, the position where most of the wreckage is located and the extent of the 
wreckage field. This can most easily be done by the use of a Global Positioning Satellite (GPS) receiver and 
aeronautical charts or aerial photographs. GPS receivers are available in several forms. Small, portable receivers are 
sufficiently accurate to identify the accident site location and even general distances between objects in the debris 
pattern. See 2.3.3 of this chapter for detailed discussion of plotting with GPS receivers. 


2.1.2 Location can also be achieved by plotting the bearings and distances from known positions on a large- 
scale map or by using aerial photography of the accident site in conjunction with a suitable map. The elevation of the site 
should be determined along with any significant gradient in the accident area. In some circumstances, and when terrain 
is deemed to be significant in the investigation, it may be desirable to have a profile of the terrain prepared by a surveyor. 
Maps of the local area and appropriate aeronautical charts should be used to establish the location of the accident in 
relation to airways facilities and to airports. Airport lay-out charts and approach charts should be used in connection with 
accidents occurring during the approach or take-off phases of flight. 


2.2 ACCIDENT INVESTIGATION PHOTOGRAPHY 


Introduction 


2.2.1 Photography is an important element of the investigation process. Clear, well composed photographs allow 
the investigator to preserve perishable evidence, substantiate the information in the report, and illustrate the 
investigator's conclusions. Every accident investigator needs a basic knowledge of photography. This allows the 
investigator to take quality photographs or to communicate effectively with a professional photographer in order to obtain 
photographs that contribute to a clearly written report. 


Equipment 


2.2.2 When selecting equipment, the investigator should keep in mind that aircraft accident sites are not always 
conveniently located. The investigator never knows how far the equipment has to be carried, what harsh conditions will 
be encountered during operations or if electrical power or telephone and internet access will be available. An 
investigator's equipment should be compact and lightweight to make it easily portable and it should be easy to use under 
any conditions. 


2.2.3 Cameras. The camera should be durable and reliable. It must have enough features to fulfill the 
photographer’s needs. The controls should allow for easy operation, even when the photographer is wearing gloves. The 
camera shutter should synchronize with an external electronic flash attachment. Its lens should have sufficient zoom 
range to accommodate most situations, and should provide macro capability — the ability to take close-up photographs. 


Ml-2-1 


II-2-2 


Manual of Aircraft Accident and Incident Investigation 





If the camera depends on electrical power for its operation, extra batteries should be available. There are a number of 
different types of cameras available to the investigator but, whatever the format of the camera selected, it is essential 
that the person taking the photographs have experience taking outdoor photographs under adverse and traumatic 


conditions. 


a) 


Disposable cameras are made by nearly every major manufacturer of photographic film in the world. 
They are simple to use. Many have a built-in electronic flash. The camera is turned in to the 
processing laboratory and is not returned to the user. The user gets the negatives and prints, and can 
have the photographs scanned and stored digitally. These cameras take good, clear photographs as 
long as they are used within their design parameters. The lenses on these cameras are fixed focus, 
and cannot be used for close-up photography. There is no provision for adjusting exposure to account 
for different lighting conditions, other than activating the flash. The flash is powerful enough to be 
effective for working distances of two to three metres. These cameras are inexpensive, small and 
compact, very simple to use, and make good photos. If the investigator has a more complex camera, a 
disposable camera makes a good backup in case the primary camera becomes inoperative. 


Point-and-shoot cameras are more versatile than disposable cameras. The ones currently on the 
market are usually fully automatic and therefore the camera makes focus and exposure adjustments 
itself. Many have zoom lenses. Some have macro capability. They use either film or digital medium. 
These cameras are versatile, compact, lightweight, easy to use and available for harsh weather 
conditions. They are an excellent choice for investigators who are new to photography. 


Single lens reflex cameras are so called because a mirror between the camera’s lens and the film or 
light sensor directs the light coming through the lens to a focusing screen that is used by the 
photographer to compose and focus the photograph. In essence, the photographer sees what the 
camera sees. These are the most versatile cameras available to date and, with the proper 
accessories, can handle almost any photographic task in accident investigation. They require the most 
knowledge of photography and experience in their use on the part of the investigator in order to be 
used effectively. Single lens reflex cameras are available that use either conventional film or digital 
medium. 


Video camcorders are extremely useful to investigators. Modern ones are light and compact and the 
video digital medium can be edited on a computer using simple-to-use software. Investigators should 
use video recorders to record fire fighting and rescue activities at the accident, to make notes during 
the accident site walkthrough, to record the steps in removal of wreckage, loading it on the vehicles, 
and unloading the vehicles into a hangar or other storage area. At least one video camera should be 
used to record the steps involved in component teardowns. 


2.2.4 Accessories make the task of photographing wreckage easier and help the photographer improve the 
quality of the photographs. Here is a list of accessories useful to accident investigators. 


a) 


Lenses. Accessory lenses may be auxiliary, which mount on the camera’s primary lens, or 
interchangeable, in which case the primary lens is removed and another is installed. A zoom lens with 
a range of 28mm to 135mm for a 35mm film camera, or its equivalent for a digital camera, that also 
has macro focusing capability, is ideal. Having all these features combined into one lens reduces the 
need to carry heavy accessories. 


Flash. Flash is useful for filling shadows in bright sunlight. Most point-and-shoot and many single lens 
reflex cameras have a flash built into the camera. These provide supplementary illumination for use in 
marginal lighting conditions, but usually are not powerful enough to fill shadows when photographing 
in bright sun. Since they are part of the camera, the photographer has no control over the angle of the 
light when using one. The best flash attachment for an investigator is one that can be detached from 


Part Ill. Investigation 
Chapter 2.__ Wreckage Investigation Ill-2-3 





the camera and aimed independently. Flood lights, photographic lighting or video camcorders with low 
light capabilities are useful at night or in low visibility conditions. 


c) Filters. These attachments mount on the front of the camera’s lens and filter the light that reaches the 
film or sensor. The ones most useful to investigators are the UVa, UVb, skylight, and polarizer. Many 
photographers install a UV or skylight filter over the lens to protect it from dust, moisture, salt spray or 
other hazards. UVa and UVb filters remove ultraviolet light which is rendered on film as blue, causing 
the photographs to appear hazy. Skylight filters are useful when taking pictures in shade and 
counteract the tendency of the light from the blue sky to influence the color of the photograph. A digital 
camera can normally compensate for this by adjusting the white balance. The polarizer is useful for 
reducing reflections off water, glass and other materials. It will not, however, reduce reflections off 
metal surfaces. Check the camera’s instruction manual. 


d) Camera supports. The most commonly used camera support is the tripod. Select one that is both light 
and sturdy. It should have a full range of elevation adjustments including the ability to position the 
camera close to the ground to enable the investigator to take close-up photos of wreckage on the 
ground. 


e) Cable/remote release. This attachment enables the photographer to take the picture without inducing 
movement in the camera that can cause a blurred image. 


f) Notebook. A notebook or other means of record keeping is necessary. Take notes that will allow you 
to identify each photograph by subject matter and significance. Some cameras also allow for date/time 
marking which can be useful in record keeping. 


Film and electronic media 


2.2.5 Some investigators still use film as their recording medium; however, digital media are rapidly taking over 
chemical film as the medium of choice for investigations. High quality digital cameras provide clear, top quality 
photographs that are easy to archive, edit, and insert into briefing materials and reports. With digital media, the 
investigator has the photograph immediately available; there is no delay for processing and printing of the film. The 
investigator has physical control over the images from the start, eliminating the chance of loss or damage to film or 
compromise of proprietary information. The investigator can immediately view the picture and determine if it is 
acceptable or if another view is necessary. Also, because of the large capacity of new digital cameras, several hundred 
photographs can be retained, or multiple memory devices easily carried allowing almost unlimited numbers of digital 
photographs at minimal expense. These can be transmitted over the internet by simply attaching them to an e-mail. 
Cellular telephones now have this option and could be used by investigators at various locations of a disbursed site to 
rapidly exchange visual images. 


What to photograph at the accident site 


2.2.6 The general rule in accident site photography is to start with the most perishable evidence and work to the 
least perishable evidence. Appendix 1 to Chapter 2 is an investigator’s checklist for accident site photography. 


2.2.7 Begin by using a video camera to record firefighting and rescue activities. Place the camcorder on a tripod 
and zoom the lens back to cover the whole site. Turn it on and let it record continuously. For a response that takes a 
long period of time, be ready to change tapes as they are consumed. If you have more than one video camera, get video 
from as many vantage points as possible without interfering with the response activities. The video will be valuable later 
for a number of uses. It will provide a record of the response. Investigators can use the video to determine what damage 
was caused by responders and what damage was caused by the accident itself. The video can be used to train fire 
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fighting and rescue crews. If you can do so without endangering yourself or interfering with the response, photograph 
other perishable items of evidence such as ground scars and skid marks. 


2.2.8 As soon as the fire is extinguished and the accident site is declared safe for investigators to enter the area, 
photograph any remaining skid marks and ground scars. The local medical examiner will begin removing the human 
remains, if any, from the scene. All pieces of human remains should be photographed and catalogued before they are 
moved. Any other medical evidence such as tissue smears on wreckage should be photographed as soon as possible. 
Additionally, document any damage to private property. 


2.2.9 The next step is to take aerial photographs of the site. An easy and effective way to accomplish this is to 
use a contractor who specializes in aerial photography. If you hire an aerial photographer, make sure the photographer 
understands exactly what information you need to capture. If you take the photographs yourself, an effective way is to 
use a helicopter. When taking photographs from a helicopter, remember to secure yourself and your equipment. Hold 
the camera so that the lens axis is as near to the vertical as possible. Take several photos from each position using 
different exposures. Use a high shutter speed to obtain the clearest images. Do not allow the camera to touch the 
helicopter’s structure during exposure because this will allow the vibrations from the helicopter to be transmitted to the 
camera, degrading the clarity of the image. Have a piece of equipment, such as a vehicle, in the photos to provide a 
sense of scale. If possible, take aerial photos at different times of the day. The different shadow patterns will reveal 
different details. 


2.2.10 During the initial walkthrough of the accident site, it may be helpful to have an assistant carry a video 
camcorder. Record initial impressions as video notes with a voice accompaniment. This can also be used as a briefing 
tool for newly arriving members of the investigation team, and to hazardous material mitigation crews and medical 
personnel for the recovery of passenger fatalities. 


2.2.11 The next major photography task is to photograph the wreckage. If the wreckage is concentrated in a small 
area and all of it is easily seen from a single vantage point, photograph it from all cardinal and intermediate compass 
points. The photographer should stand the same distance from the center of the wreckage while taking each photograph. 
Be sure your notes reflect the direction you were facing at the time. If the wreckage is spread out over a large area, it 
may not be practical to photograph the whole scene. In this case, photograph each significant piece or group of pieces 
of wreckage. As a minimum, take a photograph from all cardinal compass points, then move closer to show details. Be 
sure to note the location of the piece or group of pieces of wreckage on the accident diagram. Take photos that illustrate 
damage to the components, fracture surfaces, and witness marks. The photographer or investigator should never try to 
reassemble broken parts as this may destroy the fracture surface and disturb the evidence of the cause of the failure. 
When the wreckage is removed from the site or if it is moved to provide access to other evidence, be sure to photograph 
it before it is disturbed. Whenever major pieces of wreckage are moved from the site, use a video recorder to record the 
process of preparing them for transport, loading them onto the vehicle, and removing and setting them up at the 
destination. Whenever components are dismantled or cut open, record the process on video if possible. Other significant 
pieces of evidence to be photographed include evidence of fire, heat discoloration of structures, structural fractures, 
switch positions, and circuit breakers. Any damage to nearby trees and foliage should be photographed, as well as 
ground scars from pieces of wreckage after the aircraft initial breakup. Photograph the impact point from a vantage point 
that is along the flight path of the aircraft. Anything found in the wreckage that should not be there should be 
photographed. Also photograph anything that has a critical component missing. For instance, if the investigation reveals 
a missing cotter pin on a critical fastener, photograph that fastener and also photograph one that shows a normal 
installation. 


2.2.12 Environmental conditions should also be documented if there is any possibility that weather, sun angle, 
visual illusion or lack of visual reference may have contributed to the accident. This would require not only the 
documentation of weather conditions as soon as possible at the time of the accident, but to recreate the sun or moon 
angle and conditions at another date under the same representative conditions. This may also be accomplished by 
simulation, especially when controlled flight into terrain is being investigated, so as not to hazard another aircraft in 
attempting to recreate the accident conditions. 
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2.2.13 Considering the cost of an aircraft accident and its investigation, photography is inexpensive. Take as 
many pictures as needed. Take one photo at the normal exposure, then take the same subject at half, then double, the 
camera’s indicated exposure. Photographers call this technique “bracketing.” It ensures that at least one photograph will 
be properly exposed. Move your flash attachment, if you’re using one, to have the subject illuminated from several 
different directions. Take notes along with the photographs. The notes must contain enough information to later identify 
each photograph and its significance. This is not as important when using a digital camera, as each photograph can be 
reviewed immediately to see if it contains the necessary information. 


How to take a good photograph 


2.2.14 To take a good photograph, a photographer must consider five variables: composition, subject lighting, 
lens focus, lens opening, and shutter speed. Familiarity with the photographic equipment is essential, and practice under 
adverse conditions is recommended. In addition to photographing accident and incident training sessions or classroom 
conditions, aircraft accident photographers can also cross-train with industrial fire fighters or criminal investigation units 
for additional experience. 


2.2.15 Composition is the arrangement of the subject in the photograph. Here are some hints for effective 
composition. Move in close. Make your subject fill the frame as nearly as possible. Remove extraneous details and 
distractions. This is not always possible in accident photography, as other evidence may be damaged in the process. To 
get around this problem, photograph each piece and the distracting elements as found, then cover distractions with 
fabric or move the piece to where it can be photographed without a distracting background. A sheet of canvas in a 
contrasting shade or colour makes a good background. Include a ruler, measuring tape, or common object of known size, 
such as a pencil, in the picture to give the viewer a sense of the subject’s size. Take your photograph from several 
different angles to ensure it contains all the necessary information. Digital cameras have an advantage here. They allow 
the investigator to review the photographs immediately to see if they contain the necessary information and are of 
sufficient technical quality. 


2.2.16 The next consideration is lighting. The best light to photograph wreckage is soft, diffuse and even. An 
overcast day is usually perfect. Shadows will not obscure details and the diffuse light will not cause excessively bright or 
distracting reflections off metal surfaces. These conditions might not be present at an accident site, so the investigator 
must control the light in other ways. If a small piece of wreckage is in bright sun, photograph it as found. Use a skylight 
filter or the camera’s white balance to counter the slight blue cast characteristic of shade. Finally, the investigator can 
use flash to fill any shadows. Figures IIIl-2-1 and Ill-2-2 illustrate the effect of fill flash. Most automatic camera/flash 
combinations are designed with a setting for filling shadows in strong sunlight. 


2.2.17 Properly focused images are essential to effective photographs. Most modern cameras focus automatically, 
and many allow the photographer to override the automatic focus feature and focus manually. The general procedure is 
to select the most important part of the subject and focus on that part. Then compose the picture in the camera’s 
viewfinder and take the photograph. If your camera has automatic focusing, it probably has a “focus lock” feature that 
allows the photographer to lock in the focus on a selected part of the frame and then recompose the picture. See your 
camera’s instruction manual for how to use this feature on your camera. 


2.2.18 The lens opening controls the intensity of the light on the film or sensor. The lens opening marked on the 
adjustment ring (a number such as 1.2, 1.4, 2, 2.8, 4, 5.6, 8, 11, 16, etc.) is simply the focal length of the lens divided by 
the diameter of the lens opening. The lens opening numbers are called F-stops. The light intensity on the film or digital 
sensor decreases as the numbers get higher, and each successive F-stop concentrates half as much light as the 
previous one. In dim light, photographers use a wide lens opening and, conversely, they select a small lens opening in 
bright light. Most modern cameras have a feature that will select the lens opening automatically. There are times when 
the photographer will find it advantageous to select the lens opening manually. Selecting a wide lens opening will 
decrease the depth of field of the image. Depth of field is the distance from the nearest point to the most distant point in 
the image that is in acceptable focus. Conversely, closing the lens to a narrow opening (called “stopping down”) 
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Figure Ill-2-1._ This photograph illustrates the problem of taking photographs on a clear day 
with bright sunlight as the only illumination. It was made to illustrate heat damage to the turbine section. 
Note that most of the detail of the damage is lost in the shadows. 





Figure Ill-2-2. This photograph was made using a flash attachment powerful enough to illuminate 
the shadowed areas of the photograph on a clear day under full midday sun. 
The damage to the engine turbine section is clearly visible. 
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increases depth of field. Investigators can use this characteristic of all lenses to their advantage. While selecting a small 
lens opening can keep everything in the image in acceptable focus, the investigator may wish to open the lens to 
intentionally make distracting elements of the photograph out of focus, and concentrate the viewer's attention on a single 
element in the composition. See Figures II|-2-3 and IIl-2-4 for examples of how lens opening affects depth of field. If you 
choose to manually control the lens opening, you'll have to select the appropriate shutter speed. The camera may be 
designed to do this automatically. Check the camera’s instruction manual for “aperture preferred” exposure control. 


2.2.19 Shutter speed controls the amount of time the light falls on the film or sensor. Shutter speeds are usually 
expressed in fractions of a second and, on most cameras, the speeds on the selector control are marked in increments 
(1, %, %, 1/8, 1/16, 1/30, 1/60, 1/125, 1/250, 1/500, 1/1000, 1/2000, 1/4000, etc.), where each successive marked speed 
is half the duration of the previous one. There are a number of techniques for selecting the appropriate shutter speed. A 
speed of 1/(ISO speed) of the film or selected sensitivity of the digital sensor is usually a good starting speed. For 
example, for a film speed of ISO 100, use a shutter speed of 1/125 s. In order to avoid image degradation due to camera 
shake, select a speed that is at least 1/(lens focal length). When using a lens whose focal length is 100 mm, use a 
shutter speed at least 1/100 s or 1/125 s. If you chose to manually control the shutter speed, you will have to select the 
appropriate lens opening. The camera may be designed to do this automatically. Check the camera’s instruction manual 
for “shutter priority” operation. 


Suggestions for better investigation photographs 


2.2.20 Ensure your subject is identified. The best technique is to write the identifying information on a large index 
card and place it adjacent to the subject so that it appears in a corner of the photograph. Take good notes as to subject 
and significance of each photograph. Investigators may take thousands of photographs during an investigation. Good 
notes allow the investigator to retrieve and identify important photos. Include a ruler or object of known size in the 
photograph to give the viewer a sense of the object's size. 


2.2.21 Hold the camera as steadily as possible and press the shutter release as carefully as possible so as not to 
shake the camera. When using a slow shutter speed or taking macro photographs where the depth of field is very 
narrow, place the camera on a tripod to prevent movement from degrading the image or casting the subject out of focus, 
and use the cable or remote release. 


2.2.22 Take most of the photographs in color. Occasionally, objects like fracture surfaces and structural cracks 
show up better in black and white. In that case, digital photographs can be converted from color to black and white by 
using the editing software in the computer. 

2.2.23 Small pieces of wreckage may have an irregular shape that makes it difficult to position them on a work 
surface. To aid in positioning these objects, a bag of rice or dried beans covered by a piece of neutral-coloured fabric 


may be used to hold and position the subject. 


2.2.24 If the subject is a damaged or defective component, photograph a normal component for comparison. 


Coordinating with a professional photographer 
2.2.25 Ensure the photographer is aware of what to expect at the crash site, has an understanding of site hazards 
and has all the necessary personal protective equipment and knows how to use it. The photographer should know not to 


disturb anything in the crash site. Here is a list of suggested equipment and supplies the photographer should bring: 


a) two 35mm single lens reflex cameras or two full-featured digital single reflex cameras; and 
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Figure Ill-2-3. This photograph was made with the lens at a relatively small aperture for 
maximum depth of field. Note that everything in the frame is in clear focus. 
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Figure Ill-2-4. This photograph was made with the lens at a relatively wide lens opening. 
Note that the crossbar in the lower foreground is out of focus. The instrument panel is in clear focus 
and the viewer’s attention is drawn to the instrument panel. 
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b) Zoom lenses covering 28-135mm focal lengths for a 35mm film camera or equivalent for a digital 
camera 
Macro lens 
Powerful external flash that can fill shadows in strong sunlight 
Exposure/flash meter 
Tripod 
Cable release 
Polarizing, UVa/b and skylight filters 
Gray card, color scale 
20 rolls of 35mm, 36 exp colour negative film or equivalent digital storage 
Extra batteries to support that volume of photographic activity 
A sturdy case to provide portability for the equipment and protection from the elements. 


Everything on this list is a basic tool of the trade for a professional photographer and virtually all photographers carry 
these items on assignments. 


2.2.26 This section has covered the basic techniques of accident investigation photography. There are many 
other photographic techniques that may be of value to the accident investigator. These techniques are explained in the 
numerous books available in book stores and photo specialty stores. Many are explained in the instruction books that 
are supplied with the cameras. Read the instructions that come with the camera and several books on photographic 
technique. Practice using all the photographic equipment in the investigator’s kit until its use becomes second nature. 
This will allow the investigator to make the best use of available time and obtain the best possible photographs. Utilize 
the equipment frequently to ensure it operates correctly. 


2.3. WRECKAGE DISTRIBUTION 


2.3.1 The investigation at the accident site should begin with an assessment of the wreckage with particular 
attention to ensuring that major structural and flight control surfaces are within the wreckage pattern. In a cursory 
examination of the site determine that the major structural members are present: wings, vertical and horizontal tail, the 
correct number of engines, the correct number of propellers and propeller blades, etc. As the initial survey continues, it 
should be determined whether all flight control surfaces are present as well; ailerons, flaps, elevators, trim tabs, spoilers, 
etc. As the number of surfaces may be quite extensive, a common practice is to have each member possess a simple 
diagram of the aircraft (usually obtainable from the operator’s or maintenance manual). As each structural section is 
identified and each flight control surface is found, the appropriate part of the illustration can be “coloured in”. Later, all 
illustrations can be compared to assure the investigation team that the entire aircraft is at the site. The lack of a major 
section, or control surface may be indicative of a loss prior to impact and the effort to recover the missing parts should 
begin as soon as possible, hence the need to accomplish this basic inventory early in the investigation. 


2.3.2 An assessment of the basic terrain features surrounding the accident site should be made prior to detailed 
analysis. If the terrain rises where the impact occurred, the evidence of impact may indicate a steeper angle than would 
exist if the terrain were level or descending. Similarly, if the area is heavily forested, the degree of impact may be greater 
than if the area were devoid of large structures or vegetation. 


2.3.3 The investigators should determine the scope of the aircraft breakup. If extensive, this may be 
accomplished by a site walk-through. Beginning at the point of initial contact with the ground, the investigator should 
attempt to determine a basic breakup direction and begin walking that line. Identification of structure or parts along the 
path can be made, noting whether they are straight ahead or to the left or right. A preliminary sketch of the wreckage 
might be made without great effort as to scale. When the last parts are noted in the line walked, it might be assumed that 
no other parts exist further down. The investigator should continue the line for some distance assuring that what was 
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suspected to be the last parts are, in fact, so. Frequently, heavy objects having great inertia may lie well beyond the 
normal wreckage pattern. Once the length boundary is determined, the investigator should similarly determine the width 
to either side. All investigative efforts can then be concentrated within an established boundary. This facilitates 
investigative assignments and assures that investigation team members do not stray beyond the boundaries without 
coordination with the investigator-in-charge. In the case of in-flight breakup or mid-air collision, radar data may be useful 
to identify the initial debris field and extent of wreckage disbursement. This will also be vital in over-water accident site 
determination. 


Retrieving recorded media 


2.3.4 Field investigation should begin with the determination of all recorded media carried on board the aircraft. 
In addition to flight data recorders and cockpit voice recorders, investigators should be aware of any other data storage 
which may provide valuable information. Such media may be contained in quick access recorders, and non-volatile 
memory in printed circuit boards. Manufacturer and operator representatives should be consulted for this identification. 
Installation locations and appearance should be well understood before making any wreckage survey so that these 
valuable sources of evidence can be identified and retrieved before data is further compromised by time and conditions. 
Any special handling information for media, such as water immersion or static-safe bagging, should be included prior to 
handling or removing the component. Flight and engine performance data may have been transmitted to the air carrier 
operations or maintenance facility through an automated data-link reporting mechanism, and should be made available 
to the investigation team. 


Staking the wreckage 


2.3.5 As identification of small parts is made, and especially as objects are removed, the investigator should 
place a visible stake in the ground to identify the location. This maintains the integrity of the accident site for future 
activities such as returning to the location later to have an expert remove a small, damaged part or to find something 
related to an object previously removed. 


2.3.6 Care should be taken to utilize stakes that are visible to the investigators. Common practice at airports is to 
have a supply of small wire stakes with colored flags at the top. The advantage is that many stakes can be carried out to 
the accident site. However, if the foliage is extensive at the site, the flags may not be visible, making them less usable. 
At the other extreme, stakes provided to investigation teams have been as large as a 2-inch by 2-inch by 4-foot wooden 
stake. While such a stake can be easily seen once placed, it requires a heavy hammer to place it into the ground firmly. 
In addition, an investigator cannot carry many stakes at once, making repeated trips to the supply necessary. This is not 
to say that these extremes are not useful in certain environments, but the investigator should strive to use the best 
stakes for the site at hand, not just what was initially provided. 


2.3.7 As each stake is placed, it should be identified with a unique identification number and its number and 
significance noted in a log. A master log can be assembled by the investigator-in-charge so that return to specific 
locations or identification of distribution patterns can be made. When several investigators set out to examine the site 
and stake significant parts, it might be useful to assign a numbering system to each investigator. For example, one 
investigator is assigned stakes numbering 1-99, another is assigned stakes 100-199, and so on. In this way, no two 
stakes have the same number and a master distribution chart can be made. Care should be taken with the identification 
of the stake so the information remaining on it is not lost. A weather-proof tag with the stake number and an identification 
of the object written upon it is useful. An effective method is to issue a “permanent” marker to each member so that the 
identification number and object description can be placed on both sides of the stake. These markers should retain the 
information for the time an investigation team needs them. 


2.3.8 As mentioned above, stakes should be placed to allow return to small parts for later removal or placed 
whenever something is removed for further examination. Stakes should also be placed where human remains are found 
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and removed. In all cases, a photograph with the stake and object together may prove useful later. In addition, 
significant ground scars might be staked. If the ground scar is long, it may be useful to put a stake at either end. 
Similarly, if the scar has a curve or a significant pattern, it may require multiple stakes to be able to duplicate the pattern 
after the ground has been altered and/or covered by wind, precipitation or equipment movement. Consideration should 
also be made for marking items in swamps and heavy undergrowth where normal stakes and tags will not be visible. 


Using Global Positioning Satellite (GPS) location 


2.3.9 As the availability and accuracy of Global Positioning Satellite (GPS) receivers improves, their use at the 
accident site makes it easier to accomplish the tasks at hand. Where previously a survey team had to return to the 
accident site and plot the position of wreckage/stakes for the investigators, the investigation team can now combine the 
initial wreckage debris identification and staking effort with an associated position entered into a GPS system’s database. 
The final chart (see 2.3.4) then becomes a matter of combining locations from the different GPS plots into a useful chart 
during the investigation. 


2.3.10 The accuracy of GPS receivers varies with the technology involved. Military GPS receivers may be able to 
plot positions accurately down to centimetres or inches. Commercially available hand-held receivers may only be able to 
determine position as close as three to five metres (10-15 feet). However, it should be noted that during a survey, while 
the positions of all the surveyed points may only be within five metres (15 feet) of absolute accuracy, the surveyed 
positions of points remain constant and maintain their relative positions. Caution should be taken to ensure all the charts, 
GPS receivers and surveyed positions use the same geodetic survey databases in the most current revisions to 
eliminate or minimize errors and confusion from various data/reference sources. 


2.3.11 Since the reference satellites may be different or in slightly different positions when the surveying was 
done, it is important that surveying of all the relevant positions be done at the same time and with the same GPS 
receiver. If the previously captured geographical position is not available (documented), the investigator should establish 
one stake for this purpose. 


2.3.12 While the different models of portable GPS receivers make specific instructions irrelevant to this manual, 
there exist some common capabilities. Some units also have terrain features which can be particularly useful in adverse 
conditions or in widely disbursed accident sites. Most units allow locations to be entered into the GPS receiver database 
as numbered “waypoints”. These waypoints are sequentially numbered automatically by many GPS receivers, 
eliminating the need for time-consuming data entry. However, some units allow short descriptive terms to be entered. 
This should be done only when doing so provides meaningful information that cannot be duplicated later. 


2.3.13 The number of waypoints available varies, but it is likely that more points will be identified during the field 
examination than a single GPS can hold. For this reason, a download of the points to a computer on a daily basis (or 
when full) should be made into a discrete file. The waypoints can then be cleared before the next venture into the field 
allowing a full availability of the waypoint assignments. 


Wreckage distribution chart 


2.3.14 After the initial study of the general scene of the accident has been made and photographs taken, the first 
step in the actual investigation is usually that of plotting the distribution of the wreckage. In simple terms, this is done by 
measuring the distances and bearings of the main wreckage and also of the scattered parts of the wreckage, including 
the contents of the aircraft, survivors and victims and all impact and ground markings, and then recording this 
information on a chart to a convenient scale. 
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2.3.15 While in many accidents the preparation of a wreckage distribution chart is a task considered to be well 
within the capabilities of an investigator, if a GPS plotting has not been accomplished, consideration should be given to 
employing the services of a qualified surveyor when the circumstances of the accident are such that there has been 
extensive scattering of the wreckage. 


2.3.16 The preparation of a wreckage distribution chart is worthy of painstaking effort to ensure its completeness 
and accuracy, for the study of the completed chart may suggest possible failure patterns or sequences, and the 
significance of later findings may often depend upon reference to the original chart. It will not only be used as a 
reference document throughout the investigation but also will remain a most important document for inclusion in the 
investigator's dossier to supplement the written report. 


2.3.17 In determining the type and amount of information to be included on the chart of any specific accident, the 
investigator must be guided by the circumstances surrounding the particular accident, but in most cases the chart should 
record the locations of all major components, parts, accessories and freight, and the locations at which the accident 
victims were found, or survivors located and, if available, their identities. The initial contact markings and other ground 
markings should also be indicated on the chart with suitable reference to identify the part of the aircraft or component 
responsible for the marking. When terrain features appear to have a bearing on the accident or on the type or extent of 
structural damage, they too should be noted on the wreckage distribution chart. Pertinent dimensions, descriptive notes 
and also the locations from which photographs were taken add to the completeness of the chart. 


2.3.18 The preparation of a wreckage distribution sketch may be accomplished in various ways, but the following 
are some examples of simple methods: 


a) when the wreckage is concentrated in a small area, distances and bearings (magnetic) can be 
measured from a central point of the wreckage. The plotting of the items can be made on a polar 
diagram (see Appendix 2 to Chapter 2); 


b) when the wreckage is scattered, a base line can be laid out usually along the main wreckage trail, 
dependent upon the terrain, and distances measured along the base line from a reference point and 
then perpendicularly from the base line to the scattered pieces of wreckage. A chart is then prepared 
from this information using a suitable scale. The use of squared paper may be useful in preparing 
simple plots (see Appendix 2 to Chapter 2). 


2.3.19 Where there are many pieces of wreckage the presentation of the chart can be simplified by using a letter 
or a numeral for each item and preparing a suitable index for inclusion on the chart (see Appendix 4 to Chapter 2). 


2.4 EXAMINATION OF IMPACT MARKS AND DEBRIS 


2.4.1 The marks of first impact of the aircraft with the ground should be found. From these and the distribution of 
the wreckage, it can usually be determined which part of the aircraft struck the ground first. The path of the aircraft may 
be deduced by careful examination of ground marks or scars upon trees, shrubs, rocks, poles, power lines, buildings, etc. 
Wing tips, propellers or landing gear leave tell-tale marks or torn-off parts at points of contact with fixed objects. Ground 
scars used in conjunction with height of broken trees or brush will assist in establishing the angle and attitude in which 
the aircraft struck the ground. Examination of the victims of the accident and the contents of the aircraft can also assist 
in establishing angle, attitude, and speed at impact. The general state of distortion and “telescoping” of the structure will 
permit an investigator to deduce whether the aircraft crashed at high or low speed. Usually only local damage occurs at 
low speed impact, but at high speed wings and tail become buckled and foreshortened. Cases have occurred in which 
the aircraft has been completely buried in a deep crater, with only a few twisted fragments dispersed adjacent to the 
impact site. Short straight furrows running out from each side of the crater told where the leading edges of the outer 
wings had hit the ground while traveling almost vertically downwards at very high speed. When engines have not 
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penetrated into the ground, their vertical descent speed has probably been small, but the aircraft might have been 
travelling very fast at a shallow angle and, in such circumstances, the wreckage will be spread far along a line from the 
mark of first impact. If the wreckage is widely scattered along the flight path, this may indicate that some structural 
disintegration had occurred before impact with the ground. It is usually possible to form a preliminary mental picture of: 


a) the direction, angle and speed of descent; 

b) whether it was a controlled or uncontrolled descent; 

c) whether the engines were under power at the time of impact; and 

d) whether the aircraft was structurally intact at the point of first impact. 


2.4.2 The extent of the damage to the wreckage will give some preliminary indication of the evidence that can be 
obtained from it by subsequent detailed examination. If structural disintegration in the air is suspected, it is essential to 
plan the investigation to ensure that all information which will help to trace the primary failure is extracted from the 
wreckage before it is moved. In such circumstances aircraft wreckage may be scattered over several miles of woodland, 
field, marsh, or built-up area and may be difficult to locate. Search parties should comb the district and the search should 
be continued until all significant components have been found. The cooperation in the search of military personnel, 
police, schools and local residents should be requested, but at the same time searchers should be informed of the need 
to report the location of pieces of wreckage without disturbing them. This will enable the investigator to examine and 
determine the exact location of such pieces as they fell to the ground. Light detached portions of low density tend to drift 
in the direction of the prevailing wind at the time of the accident whilst dense objects will be less affected by wind effects, 
and knowledge of this direction may save time in locating aircraft pieces. No piece of wreckage should be disturbed or 
removed until: 


a) its position is recorded; 


b) an identification number is painted on it on an undamaged area, or in the case of small portions, a 
label attached; and 


c) notes are made of the manner in which the piece struck the ground, what the nature of the ground 
was, and whether it hit trees or buildings, etc., prior to this. 


2.4.3 Such notes and photographs will be very valuable when a later detailed examination is made and may help 
to separate ground impact damage from other damage. A special search should be made for any part of the aircraft not 
accounted for at the accident site and if it cannot be located the fact must be recorded. 


2.4.4 In the case of accidents associated with wheels-down landings, tire marks should be carefully recorded 
and examined. The width of the tire imprint of each wheel and the density of the color of the marks should be noted. The 
tire marks may well provide evidence of braking or skidding or sliding and, in particular, may provide a clue to a hydro- 
planing situation. A hydro-planing tire may leave a very distinctive whitish mark on the runway. These tracks are the 
result of a scrubbing action which is provided by the forces under the tire during hydro-planing. 


2.4.5 It should never be overlooked that the victims of an aircraft accident, if objectively examined in the same 


manner as the aircraft wreckage, may reveal important information relating to aircraft speed, aircraft attitude at impact, 
sequence of break-up, etc. This is referred to in more detail in the human factors investigation. 


Appendix 1 to Chapter 2 


Accident Investigator’s Photography Checklist 


This is a checklist for photography that can be used at an aircraft accident site. It lists what should be photographed at 
the beginning of an investigation, before the scene is disturbed. As the investigation progresses, it will be determined, on 
the basis of the evidence found, if other photographs need to be taken. 


Immediately following the mishap: 


ONS 


Fire fighting (Video) 

Rescue activities (Video) 

Radar and ATC (Recordings) 

Weather (forecast and actual conditions) 


Once the investigation begins: 


@ONOaARWNS 


SN co) 
OMNOAATARWNHAO' 


Aerial view of the site (Video) 

The site ground view from each cardinal compass position 
The site from the direction the aircraft was traveling at impact 
Ground scars 

Damage to trees and foliage 

Skid marks 

Photo inventory of major wreckage components 

Flight control surfaces and actuators 

Landing gear and other hydraulic components 


. Cockpit switch positions 

. Fire/nheat damage and discoloration 

. Human remains, injuries, blood/tissue smears on wreckage 
. Extra items or items adjacent to items not accounted for 

. Close-ups of fracture surfaces 

. Close-ups of improperly installed components 


Close-ups of any other items suspected of having contributed to the mishap 


. Private property damage 
. Steps in removing, opening or cutting apart components 
. Any other photos deemed necessary 
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Wreckage Plotting Methods 
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Items to be included on the diagram in addition to location of significant aircraft parts and surface features and 
reference marks: 


a) magnetic north i) location of witnesses 

b) scale j) prevailing wind and velocity 

c) flight path k) direction of sun and elevation 

d) _ initial point of contact 1) location of navigation aids or airports 

e) location of major components m) date/time of accident 

f) centreline of wreckage flow n) point of contact for person making the diagram 
g) location of crew and passengers 0) type and registration of the aircraft 

h) location of fire pattern Pp) geodesic survey standard (i.e. WGS-84) 
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Chapter 3 


ORGANIZATIONAL INVESTIGATION 


3.1. GENERAL 


3.1.1 There has long been an acknowledgement that system breakdowns or safety occurrences may reflect 
organizational problems. In recent years there has been a growing awareness that organizational issues such as 
management systems and corporate culture must be considered in an aircraft accident investigation. 


3.1.2 The objective of the organizational investigation is to uncover characteristics of the organization which, 
although remote from the immediate circumstances of the accident, increased the probability of the accident occurring. 
These pre-existing, or latent, conditions, if not corrected, could become the cause of additional accidents. 


3.2. THE REASON MODEL AND THE ORGANIZATIONAL INVESTIGATION 


3.2.1 Accidents require the coming together of a number of enabling factors, each one significant but in itself not 
sufficient to breach system defences. Major equipment failures, or operational personnel errors, are seldom the sole 
cause of breaches in safety defences. Often these breakdowns are the consequence of human failures in decision- 
making. The breakdowns may involve active failures at the operational level or they may involve latent conditions 
conducive to facilitating a breach of the system’s inherent safety defences. Most accidents include both active and latent 
failures. 


3.2.2 Figure Ill-3-1 portrays an accident causation model that assists in understanding the interplay of 
organizational and management factors (i.e. system factors) in accident causation. Various “defences” are built into the 
aviation system to protect against inappropriate performance or poor decisions at all levels of the system: the front-line 
workplace, the supervisory levels and senior management. This model shows that while organizational factors, including 
management decisions, can create latent failure conditions that could lead to an accident, they also contribute to the 
system defences. 






ORGANIZATION 
WORKPLACE CREW/TEAM DEFENCES 
FACTORS SBOE 
ORGANIZATION ERROR AND [] [] ] 
AND VIOLATION ae 
MANAGEMENT PRODUCING ACCIDENT 


VIOLATIONS 


DECISIONS CONDITIONS [] [] 


Figure Ill-3-1 Accident causation model 
(Adapted from Prof. James Reason) 
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3.2.3 Errors and violations having an immediate adverse effect can be viewed as unsafe acts; these are 
generally associated with front-line personnel (pilots, controllers, mechanics, etc.). These unsafe acts may penetrate the 
various defences put in place to protect the aviation system by company management, the regulatory authorities, etc., 
resulting in an accident. These unsafe acts may be the result of normal errors, or they may result from deliberate 
violations of prescribed procedures and practices. The model recognizes that there are many error-producing or 
violation-producing conditions in the work environment that may affect individual or team behaviour. 


3.2.4 These unsafe acts are committed in an operational context which includes latent unsafe conditions. A 
latent condition is the result of an action or decision made well before an accident. Its consequences may remain 
dormant for a long time. Individually, these latent conditions may appear harmless since they are not perceived as being 
system deficiencies. 


3.2.5 Latent unsafe conditions may only become evident once the system’s defences have been breached. They 
may have been present in the system well before an accident and are generally created by decision-makers, regulators 
and other people far removed in time and space from the accident. Front-line operational personnel can inherit defects in 
the system, such as those created by poor equipment or task design; conflicting goals (e.g. on-time service vs safety); 
defective organizations (e.g. poor internal communications); or bad management decisions (e.g. deferral of a 
maintenance item). Effective safety management efforts aim to identify and mitigate these latent unsafe conditions on a 
system-wide basis, rather than by localized efforts to minimize unsafe acts by individuals. Such unsafe acts may only be 
symptoms of safety problems, not causes. 


3.2.6 Most latent unsafe conditions start with the decision-makers, even in the best-run organizations. These 
decision-makers are also subject to normal human biases and limitations, as well as to very real constraints of time, 
budget, politics, etc. Since some of these unsafe decisions cannot be prevented, steps must be taken to detect them 
and to reduce their adverse consequences. 


3.2.7 Fallible decisions by line management may take the form of inadequate procedures, poor scheduling or 
neglect of recognizable hazards. They may lead to inadequate knowledge and skills or inappropriate operating 
procedures. How well line management and the organization as a whole perform their functions sets the scene for error, 
or violation-producing conditions. For example, how effective is management with respect to setting attainable work 
goals, organizing tasks and resources, managing day-to-day affairs, communicating internally and externally, etc.? The 
fallible decisions made by company management and regulatory authorities are too often the consequence of 
inadequate resources. However, avoiding the costs of strengthening the safety of the system can facilitate accidents that 
are so expensive as to bankrupt the operator. 


3.2.8 For a comprehensive review of the Reason model, refer to Circular 247, Human Factors, Management and 
Organization. 


3.3. THE SIX “M” MODEL FOR ORGANIZATIONAL INVESTIGATION 


3.3.1 Organizational investigation is to discover the effect of management actions and decisions on operations, 
maintenance and support activities. Therein, we find the influences present before an accident. The factors directly 
affected by management decisions and the interrelationship between them is critical to discovering the systemic factors 
that either led to the accident sequence of events or, at least, failed to intervene with adequate defenses. Figure II|-3-2 
illustrates these factors. 
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Figure Ill-3-2. The Six “M” Model for Organizational Investigation 


Formulation of the Mission 


3.3.2 At the heart of the interrelationships are three factors which, together, provide the basis for the aircraft 
operation (the Mission) directly, the Man, the Machine and the Medium. Investigation into each of these individual factors 
is straight-forward and addressed in other sections of this manual. However, how the organization influences these 
factors should be investigated separately. 


a) The Man. Ultimately, if the accident flight was not conducted by the owner and operator directly, some 
organizational process was involved in selecting and designing the methodology used by this 
particular individual for the actions involved. It should be understood here that any discussion of “the 
Man’ is not limited to the pilot or crew members. It may well apply to maintenance, dispatch, air traffic, 
designer personnel or any other personnel involved with the operation of aircraft, including 
government oversight. 


Under this concept, the organizational policies on employment, scheduling, preparation for the 
individual’s activities, supervision of these activities and procedures for discipline should be 
scrutinized. For example, while a crew member may be directly responsible for obtaining sufficient rest 
prior to flight, the management organization may not have effective policy to protect that period and, in 
fact, may interrupt the rest period without consideration for the fatigue that may result. In this case, the 
organizational influence may well be identified as contributing to the overall effect. 
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b) The Machine. While this normally refers to the aircraft, this area includes any equipment used to 
support the aircraft during maintenance or pre-flight preparation. Additionally, the equipment used to 
respond to the post-accident environment may also be considered. Again, direct investigation as to 
adequacy of the equipment is straightforward. However, how the organization involved procured the 
equipment, how the equipment is maintained and how individuals are trained in its use should be the 
focus of the organizational investigation. Selection of the particular equipment is an organizational 
decision. For example, if the equipment was a work-around because the organization had not 
procured the correct support equipment, then the organizational influence was directly involved. 


c) The Medium. This area includes the conditions under which the other actions take place. This area 
may include the weather at the time the actions were taken and whether the actions took place during 
daylight or during periods of darkness. If in-flight, these may include whether the flight was in visual 
meteorological conditions or operating under instrument conditions. 


3.3.3 The interrelationship of the above factors is just as critical as the components themselves. These 
interfaces often become barriers to information exchange or coordinated management oversight. 


a) The Man-Machine interface. This area takes into that account any organizational actions which 
combine a piece of equipment with an individual who is in some way incompatible with that equipment. 
In aircraft, the design of the cockpit cannot accommodate all sizes of human beings. Designers use 
certain standards to allow the majority of individuals access to all controls or the ability to fully use the 
equipment. If an individual is too large, too small, has insufficient strength or another limiting factor, 
the organization should consider these limitations when selecting the individual or the equipment. 


b) The Man-Medium interface. The activity that surrounds the accident sequence should be considered 
in light of how the individual had to cope with the environment. For example, if the particular 
maintenance activity being investigated took place during the day, it may have involved activity under 
intense sun, involving blowing dust or precipitation and if the organization took no action to reduce the 
risk of error under these conditions, then the organization would be found contributing. 


c) The Machine-Medium interface. Compatibility of the equipment to effectively operate within the 
medium is central to an organization’s decision to use the equipment. For example, it would not be 
prudent to operate an aircraft into an airfield when the only available runway was less than the 
certificated minimum field length. If the organization failed to consider the limitations under the 
environmental conditions anticipated, then their its contribution is significant. 


3.3.4 Together, these factors form the Mission: the activity the aircraft was engaged in at the time of the accident. 
The organization is responsible for assigning men, machines and conducting the anticipated activities in the existing 
medium. Acceptance of the risks involved make the organizational influences contribute to the accident analysis. The 
Mission may be simply to fly from point A to point B, but the choice of time, route and conditions to alleviate any 
anticipated risks set the stage for the events which ultimately led to the accident. If the task assigned to the aircraft and 
its crew is beyond the experience of the individuals involved, it is up to the organizational structure to provide adequate 
defenses to preclude undue risks. 


Management 


3.3.5 Organization’s management administers the elements that make up the basic factors. This should include 
all levels of supervision from the most senior management officials to the supervisors of individuals directly involved. It 
encompasses all the factors discussed above because management at all levels promulgates the policy and standards 
of behaviour that create the corporate culture. This culture may be tolerant of deviations to existing rules when faced 
with an adverse or risk-increasing situation. Alternatively, the culture may be open to communication of these factors 
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only to be thwarted by middle management indecision or interference. When encountered by the investigator, it must be 
determined whether the risk associated with the culture issue is directly or indirectly involved in the sequence of events 
leading to the accident. If so, it must be examined for causality. If not, then procedures reporting discovered deficiencies 
which have accident potential should be considered for the report. 


3.3.6 Management issues should also be considered externally to the principle organization as well. In many 
cases, industry or government oversight organizations which issue, control and/or monitor operating certificates have 
their own influence on the way a latent condition or accident may occur. Just as it may be understandable when an 
individual faces a dilemma created by management’s insistence on riskier actions, the entire organization’s management 
may be influenced by an enthusiastic or an uninvolved oversight organization to the detriment of normal cautions 
afforded in the rules. 


3.3.7 Procedures. Some areas governed by management or the oversight of the employees’ actions might 
include procedures, as most organizations involved in aviation activities are required to establish procedures to assure 
regulators that operations and maintenance actions will be handled in an efficient and safe manner. Investigations into 
operations and maintenance should take these procedures into account. The organizational investigator must look for 
systemic issues that might lead procedures to create a safety problem — one that may not have been overcome by the 
individual’s actions. 


a) These may include changes in flight operations requirements by operations between individual States. 
While ICAO procedures are designed to simplify these transitions, it is left to the individual States to 
create their own operational regulations. Aircraft transitioning between States may find conflicting 
procedures which must be complied with in addition to operating within their own State’s guidelines. 


b) An organization may further restrict their operations by having procedures that “ensure” compliance 
with regulations and make management of personnel easier, for example, how an organization 
handles the crew’s rest periods. 


c) Additionally, because many regulators require that operating procedures are in an operator's own 
format, the longer an organization operates a particular piece of equipment, the longer the 
organization has published their own procedures and has added steps that make their unique 
operating environment easier to handle. Additional procedures to combat corrosion may be 
implemented if the aircraft is continuously operated in a high moisture environment. Conversely, the 
anticorrosion procedures may be minimal when the aircraft is operated in a very low humidity 
environment. Over time, procedures originally issued by the manufacturer may become significantly 
amended by individual organization manuals and procedures. The organizational investigator must 
look for this gradual shift in procedures and the application of changing procedures from the origin (the 
manufacturer) to the implementation (the operator). Standardization and harmonization of these 
documents across a larger organization is a significant administrative burden that needs to be rigidly 
enforced, especially if there is not a central reference library. Otherwise, the various parts of the 
organization are acting under different versions and revisions of operative procedures. 


d) The transfer of information from detailed guidance contained in manuals and handbooks into 
operator’s flight checklists or maintenance work cards should be examined with great care. An 
organization transfering critical data may inadvertently delete or re-arrange an action in a checklist or 
workcard. This action may leave the individual without adequate reference to apply the procedure 
correctly, especially when activity has increased in tempo such as during an in-flight emergency. 
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Funding 


3.3.8 The term “funding” refers to the adequacy of resources. Given sufficient resources, organizations rarely 
expose their aircraft, personnel or the public to unnecessary risks. As resources become scarce, methods to stretch the 
remaining resources to keep the organization operating are employed. While these methods may not present an obvious 
risk increase, over extended periods the application of resource-saving techniques may create a management culture 
that allows an unacceptable risk to enter the picture with a disregard for its impact or with an acceptance of that risk as 
“normal operating procedures.” 


3.3.9 Issues (beyond the obvious of financial resources) should be examined in this context. 


a) Availability of human resources. The availability of sufficient personnel to perform required functions is 
one area that should be investigated when a deviation from accepted practice occurs. In some cases it 
has been discovered that while crew members or mechanics were well qualified, there were 
insufficient numbers of them to keep the existing regulations in perspective. When human resources 
were limited, compromises in qualifications, crew rest or other scheduling was the common result. 


b) Quality of human resources. Similar to the discussion above, at times the experience level of the 
various personnel should be evaluated in light of the accident sequence. While the worker and the 
supervisors may be individually qualified, their ability to continue quality work depends on the 
appropriate ratio of workers to supervisors and the experience levels of each. For example, one 
organization demonstrated that a specified number of maintenance personnel were employed. 
However, the organizational investigator found that among these employees, the number of 
supervisors was extremely short, while the number of trainees was higher than ideal. Another 
condition might exist where there are sufficient supervisors, but they are mostly assigned to daytime 
duties, when the majority of maintenance activities are conducted at nighttime with minimum 
supervision. Numbers of employees do not necessarily equate to the quality of work performed. 


c) Acquisition of parts and other commodities. In organizations under the pressure of inadequate 
resources, alternative methods of obtaining needed parts may be used. While the quality of parts may 
present the investigator with another problem completely, the organizational investigator is looking for 
the mind-set that puts safety at risk by using alternative methods. For example, an organization 
requiring parts to put the aircraft back into service was found to have taken the parts from another 
aircraft. While the practice alone does not increase risk, the fact remained that the aircraft from which 
the parts had been taken was becoming a “parts store” in order to delay the purchase of the needed 
parts. Eventually the paper trail of parts removed and re-installed became unwieldy and a breakdown 
in documentation occurred. This led to the accident aircraft having parts that were not documented in 
the maintenance logs and which led to installation errors. 


3.4 POTENTIAL PROBLEMS IN AN ORGANIZATIONAL INVESTIGATION 


3.4.1 As occurrence factors become increasingly remote from the immediate time and place of the accident, the 
potential subjectivity of the investigation increases, as do the opportunities for disagreement amongst those with a stake 
in the investigation. This is not, however, justification for avoiding controversial organizational and systemic issues. 


3.4.2 It should also be borne in mind that several organizations may be implicated in an accident, each with its 
own level of involvement. The organizational factors relating to each of these organizations should be considered 
separately. 
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3.4.3 In most cultures, there is a strong tendency to search for culpable individuals after an accident and a 
corresponding reluctance to consider the role institutions such as companies or government organizations may play. 
The organizational investigator must resist such pressures, yet still consider how an effective organizational investigation 
can be conducted consistent with the national culture. 


3.5 METHODOLOGY 


3.5.1 Since each organizational investigation is unique, it is not desirable to prescribe in detail how each 
investigation should be conducted. The method section below describes how the Reason model can be applied to an 
accident investigation. This model provides a useful checklist to ensure that issues are explored and can assist in writing 
up findings in a form that is consistent with publications such as Circular 247, Human Factors, Management and 
Organization and Circular 240, Investigation of Human Factors in Accidents and Incidents. 


3.5.2 The Reason model is not the only possible method or framework that can be used in a systemic 
investigation. Other methods such as Management Oversight and Risk Tree (MORT), Human Factors Analysis and 
Classification System (HFACS) and Threat and Error Management framework (TEM) may be useful and the 
organizational investigator should not feel compelled to limit the investigation to one particular model. The importance of 
using a systematic model or process is to ensure a thorough consideration of ALL aspects of the investigation, without 
pre-judging the causes or responsibilities for the deficiencies leading to the event. 


The application of the Reason model to accident and incident investigation 


3.5.3 The organizational investigator will often rely on other groups to identify active failures, local factors and 
failed or absent defenses. As this information becomes available, the organizational investigator will be in a position to 
consider the underlying organizational and systemic factors which enabled the situation to develop. 


3.5.4 In the event of a major investigation, there may be daily briefings which will enable the organizational 
investigator to become aware of the progress of other groups. It may be appropriate, however, for the organizational 
investigator to arrange for a member of each group to act as a contact and report information which may have a bearing 
on organizational issues. 


3.5.5 In the early stages of the investigation, the organizational investigator may need to attend or review key 
interviews conducted by other groups such as ATC or Operations. This will ensure that potential organizational issues 
are not being neglected during the interview. As the investigation progresses there may be a need to conduct interviews 
specifically directed at organizational issues. 


3.5.6 In addition to relying on information from sources such as interviews and documents, the organizational 
investigator may choose to collect information via additional means such as structured survey interviews or 
questionnaires. 


3.5.7 The organizational investigator should develop a listing of the organizations that played a role in creating 
potential local or systemic factors. For example, if the accident is remote from the organization headquarters, there may 
be an intermediate level of supervision involved. Similarly, when outsourcing is used, for example, for aircraft 
maintenance, there may be several contractual relationships established involving multiple organizations. In this case, 
the relationship between each organization should be well understood to identify breakdowns in the management 
oversight and communications. Finally, as the investigator comes to understand the organization’s structure, there must 
be consideration of the government relationship with the organizations related to the issuing and continued oversight of 
the operations and/or maintenance certificates. 
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3.5.8 Potential organizational weaknesses may become apparent during the investigation. Yet these 
organizational weaknesses may have had no role in the development of the accident. If no evidence subsequently 
emerges to link these weaknesses with the active failures, local factors and defenses of the accident scenario, the 
organizational investigator should not list these weaknesses among the accident factors. Such findings should, however, 
be included in the accident report and, if applicable, they should be the subject of a safety recommendation. It might be 
appropriate to place such findings under the category of “additional information” in the accident report. 
Potential local and systemic issues 

3.5.9 In the following section, potential areas of concern are linked with possible questions which could guide an 
organizational investigator. These are by no means the only potential topics to be considered as part of an 
organizational investigation. 
Corporate goals 
3.5.10 Most organizations operate with goals which conflict from time to time, such as on-time performance and 
fuel saving. The manner in which the organization recognizes the conflict and balances goals with one another may be 
significant to the occurrence. 

Does the organization have a formal statement of goals? 

What are the performance expectations of owners, shareholders or government? 


Does the organization have a quality policy? 


Does the organization have a safety policy? 


Organizational structure 

3.5.11 This area includes factors relating to the structure and systems of the organization. 
Do problems stem from the structure of the organization? 
Are management responsibilities clearly defined? 
What actions by managers and other staff are rewarded? 


What actions by managers and other staff are punished? 


Communications 
3.5.12 Would the accident have been less likely if internal communications were better? 
Do field stations communicate with headquarters? 


Is upper management aware of operational realities? 
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Planning 
3.5.13 Does the organization operate in a short term environment? 


Does the organization have difficulty in anticipating events? 


Control and monitoring 
3.5.14 Are there adequate systems in place to inform management of key performance indicators? 


Does the organization have a hazard identification and risk management policy/programme? 


Design of systems and components 
3.5.15 Design factors are included as systemic factors because the design of systems and components is 
normally an activity remote from day to day systems operation. Some systems may not have been “designed” at all, but 
may have developed over time. Systems which are complex to the extent that their workings are not understood by 
operators (opaque systems) can be particularly problematic. 
Did the designers receive feedback on the adequacy of the design? 
Were there opportunities to modify the design? 
Do operators understand the systems they use? 
If complex technical systems are involved, is there a single person who has a general understanding of 
system operation? 
Corporate memory 
3.5.16 Have there been recent mergers or takeovers? 
Does the organization have a well maintained corporate memory? 
Are there events remembered in the “folklore” of the organization which still influence the functioning of the 
organization? 
Procedures 
3.5.17 Is there a conflict between informal norms and formal procedures? 


Would the organization fail to function if procedures were strictly adhered to? 


Are there local orders/instructions that may conflict with organizational orders/instructions? 
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Resources 


3.5.18 


Regulation 


3.5.19 


Does the organization have the resources to recruit and train staff, maintain equipment and operate 
responsibly? 


Has the organization undergone a significant reorganization, or has it recently undertaken a significant 
reorganization that has resulted in the re-distribution of resources to different parts of the organization? 


How frequently do regulators visit the organization? 
Are the regulators capable of administering the regulations? 
Do the regulators have an available range of measures (such as sanctions) to encourage compliance? 


Does the regulator require and oversee the organization’s Safety Management System? 


Adaptation to new technology 


3.5.20 


Has the organization reacted appropriately to new technologies? 


Corporate culture 


3.5.21 Does the organization condone risk taking? 

Is safety an important goal of the organization? 

Does the organization have a history of correcting problems? 

Does the organization have a history of ignoring or covering up problems? 
Safety management 
3.5.22 Does the organization have a safety management programme? 


Does the organization have a quality assurance programme? 
Is there a safety department? If so, to whom does it report? 
Has the organization recently been subject to an outside audit? 


Has there been a formal hazard analysis of the operation? 
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3.6 FINAL CONSIDERATIONS 


3.6.1 To be effective, investigations must consider the role of organizational factors, yet the investigation of such 
factors is likely to be heavily reliant on subjective judgment. 


3.6.2 One of the most important subjective considerations in an investigation is knowing when to stop. Accident 
factors may be found far removed in time and distance from the accident itself and it may be difficult to know how widely 
the organizational investigation should extend. Such a decision will be influenced by the legal framework within which 
the investigating authority operates. A useful rule is that when the organizational investigator begins to arrive at 
circumstances which are beyond the control of managers, the investigation has exceeded reasonable bounds. 


Chapter 4 


OPERATIONS INVESTIGATION 


4.1 GENERAL 


4.1.1 The operations investigation is concerned with the investigation and reporting of the facts relating to the 
history of the flight and to the activity of the flight crew before, during, and after the flight in which the accident occurred. 


4.1.2 While not addressed herein, in addition to the flight crew, the investigation should be extended to those 
personnel who are directly involved with the operations of the aircraft. These individuals, such as flight operations 
officers or dispatchers, should be examined when their role in the planning and execution of the flight operations is 
involved. Therefore, while the following centers on the flight crew, the same investigative effort should be undertaken 
when such personnel are involved. 
4.1.3 The major areas involved in the operations investigation are as follows: 

Crew histories 

Crew qualifications/proficiency 

Crew flight, duty and rest period 

Task management, crew resource management (CRM) 

Personal equipment 

Flight planning 

Weight and balance 

Maps, charts and navigation databases 

Operating guidance 

Witnesses’ interviews 

Final flight path determination 

Sequence of flight 
4.1.4 There is a close link between the work in the operations investigation and that in other investigation areas 
— for instance the flight path of an aircraft as reconstructed from air traffic control information and witnesses’ statements 
should be compared with the flight path derived from the flight recording. Such corroboration, whenever possible, 
constitutes one of the principles of a properly executed investigation, namely, cross-checking the validity of information 


from one source against information on the same subject derived from a different source. Flight tests in connection with 
some of the major areas listed above, e.g. flight path, performance, handling characteristics, are often of considerable 
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value to clarify or confirm some points of detail not only in relation to matters of direct concern to the Operations Group 
but matters interrelated with structural loading, operation of systems, engines, etc. 


4.1.5 Some topics are directly related to the operations investigation, but are addressed as separate areas in 
this manual. For example, weather, air traffic services, communications, navigation, and aerodrome facilities are covered 
in Chapter 5. Similarly, aircraft performance is addressed in Chapter 6. 


4.2 CREW HISTORIES 


4.2.1 A study of the facts pertaining to the crew forms an important part of both the operations and human 
factors investigations. Because these two aspects are closely related, a high degree of coordination in the collection and 
evaluation of the relevant facts is required to achieve the best possible use of the information collected. 


Personal record 
4.2.2 The following information should be obtained in respect of each crew member on duty: 
a) name, age, gender; 


b) duty performed on board (pilot-in-command, co-pilot, navigator, flight engineer, load master, purser, 
flight attendant, etc.); 


c) general record of aviation career (initial and subsequent training, specialized training, courses 
followed, employers and sequence of duties carried out, conditions under which various licenses and 
ratings were obtained, validity of licenses held, earlier accidents or incidents and causes thereof); 


d) medical history (including recent illness or interruption of flight activity, last medical examination, 
investigation of fatigue factor such as duty and rest time within the 28 days preceding the accident. 
Investigate the activities within the last 7 days and the last 72 hours prior to the accident); and 


e) overall experience and experience on aircraft type involved in accident (examination of flight logbooks, 
total flying times (day and night, instruments if relevant — total, within last 90 days, last 28 days and 
last 24 hours prior to the accident), type of ground training (flight simulator, etc.) and flight training, last 
proficiency checks and ground and flight checks including knowledge of emergency procedures, 
emergency evacuation drill, evaluation by supervisors, controllers or operators); and 


f) experience on the route or on the aerodrome where the accident occurred (familiarity with the route, 
IMC or VMC conditions encountered previously, number of landings or take-offs, knowledge of 
procedures). 


4.2.3 In order to gather this information, the investigator has to obtain statements from other flight crew members 
who have flown with the person concerned, and make use of the recordings of communications exchanged during 
earlier flights, as well as readout of flight data recorded on board during preceding flight stages. The extent to which any 
of the above information is required will depend on the particular nature of the accident under investigation. Interviews 
with next of kin can also allow the investigator to get valuable information on the crew history. 
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Activity before, during and after the accident 


4.2.4 The evaluation of the crew members’ activities is not solely of interest to those concerned with the 
operations investigation; in many instances such an evaluation is also relevant to the human factors, evacuation, search 
and rescue and fire prevention investigations. 


a) Activity before the accident. The investigator should examine specifically: 


1) activities within the last 7 days and the last 72 hours prior to the accident with particular reference 
to psychological factors that might have a bearing on the performance of the crew members, their 
physical condition in relation to the work/rest cycle and meal irregularity, particularly if there had 
been a substantial change of longitude on a recent flight. 


2) circumstances and distance involved in the journey to the airport before commencing crew duties 
and each crew activity in preparation for the flight, (computation of aircraft weight and balance, 
fuel load, navigation flight plan, weather briefings, pre-flight checks, etc.) 


3) the activities and watch-keeping schedule during the flight. This information is usually obtained 
from statements of surviving crew members and/or recordings or statements regarding air/ground 
communications. 


b) Activity during the accident. |In the light of the information obtained above, the investigator should 
endeavour to reconstruct the role and behaviour of each of the crew members during the sequential 
phases of the accident itself. It is also important to examine, in conjunction with the Human Factors 
Group, the contribution made by such factors as the cockpit layout, types of control levers, switches, 
etc. Similar considerations need to be kept in mind for review of the crash injury and/or survivability 
aspects. 


c) Activity after the accident. Obviously the role of the investigator and the information useful for the 
conduct of the investigation are not limited to the history of the flight and of the accident. The following 
points should also be considered: 


1) activities of the crew immediately following the accident (physical condition immediately after 
impact, conditions under which the crew evacuated from the aircraft, participation of crew 
members in the evacuation of passengers and organization of rescue, etc.) 


2) subsequent activities (medical examinations and checks already carried out or planned, ground 
and flight competency tests, various testimonies). 


4.3. CREW QUALIFICATIONS/PROFICIENCY 


4.3.1 Investigators should determine each crew member's level of qualifications to determine whether the flight 
was conducted in accordance with the crew’s experience or training. Similarly, many areas of crew activity require 
events to be performed regularly and with specific frequency. Initial qualifications alone do not indicate a level of 
proficiency necessary to accommodate the flight conditions encountered. Applicable regulations for the State granting 
certificates need to be reviewed and compared against crew training records, evaluations, and log-book entries, as 
appropriate. Investigators should be guided by the regulations, but not required to accept them as adequate. For 
example, carrying passengers for night flights usually requires a specific number of take-offs and landings at night within 
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a specific period. A pilot making the required number of take-offs and landings immediately prior to a night passenger- 
carrying flight may be qualified, but proficiency may be questioned. When this discrepancy becomes the focus of an 
investigation, the investigator may be required to turn to the regulatory authority to review the establishment of the 
regulation. 


4.3.2 Several major air carriers operate into airports that require specific crew qualifications and proficiency for 
the conditions presented. Training and frequency of operations is usually recorded in operators’ training records. 


4.4 CREW FLIGHT, DUTY AND REST PERIOD 


4.4.1 There are State regulations on the length of a crew flight and duty period and the amount of rest expected 
prior to commencing flight activities. In conjunction with the Human Factors Group investigation, the adequacy of crew 
rest periods should be evaluated. In the cases of long flight and duty periods or extended operations, the management 
of the crew duty period may become a factor. Operators keep records of crew flight, duty and rest time. Information on 
crew activities and rest can also be obtained by looking at hotel records and interviewing next of kin. The investigator 
must, however, respect the privacy of such information. 


4.4.2 When evaluating crew rest periods, the time away from work is not, in itself, an adequate measurement. 
Investigators should examine the amount of that time available for sleep, the facilities afforded crew members to obtain 
rest, and whether interruptions in the rest cycle played a role in overall crew fatigue. 


4.5 TASK MANAGEMENT, CREW RESOURCE MANAGEMENT (CRM) 


4.5.1 Frequently it is not enough to evaluate crew actions during an emergency situation with regard to the 
single emergency action performed or required. Investigators need to look at the total situation requiring crew attention. 
If the necessary actions are performed without distractions or other conditions present, the procedure required is usually 
straightforward. When the necessary action is required amidst many competing conditions, the efficiency of crew 
decisions becomes more complicated. With actions required during emergency operations, how well the crew prioritizes 
the conditions and required actions is a factor in how procedures are accomplished. At the extreme, “task saturation” 
may exist wherein some actions are not performed or even recognized. Where inappropriate crew procedures were 
performed, these may be the result of recent transition or cross-training in dissimilar aircraft with different emergency 
response procedures. 


4.5.2 Most commercial crews are well trained in the concepts of Crew Resource Management (CRM) which is 
designed to effectively communicate conditions and required actions between crew members. Effective CRM has been 
shown to reduce the potential for task mis-prioritization and even stimulate correct decision-making processes. While 
practiced and evaluated during training, the crew communications should be investigated to determine whether CRM is 
applied efficiently or whether the condition deteriorated for some reason allowing necessary communications to be 
inhibited. 


Human-machine interfaces 


4.5.3 Effective design principles are brought to bear when designing the aircraft crew stations. Controls are 
designed to be accessible when necessary and instruments and warning lights placed for effective visibility. Height, 
weight, reach, and range of motion are to be considered when designing placement of controls and displays. However, it 
is nearly impossible for any aircraft to be designed for ALL potential crew members. Frequently, older aircraft were 
designed to accommodate smaller humans than modern aircraft. Currently, most aircraft have been designed for control 
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accessibility for humans of heights from 157 cm to 193 cm. Investigators should evaluate the crew member's 
anthropometry in light of access to the controls needed during the situation encountered. Experience has shown that 
individuals that are larger (or smaller) than the designed anthropometry may have difficulties performing actions as 
designed. For example, it is not uncommon for a person of small stature to need seat pads or blocks on rudder pedals to 
effectively move the controls; conversely, these extensions may restrict full control movement. 


4.6 PERSONAL EQUIPMENT 


4.6.1 All equipment provided or taken by crew for use in performance of their duties needs evaluation for 
effectiveness and appropriateness. Whether equipment was present is a consideration but, more importantly, was the 
equipment used when called for and did it function as intended? Items such as smoke hoods, goggles, or oxygen masks 
are intended for use under specific conditions. If used, did the equipment function as designed, or were there factors 
which prevented it from providing the protection necessary? Age, condition, wear, and fit should be evaluated based on 
the individual’s personal attributes. For example, oxygen masks require a good seal to provide uncontaminated oxygen 
for the crew member when smoke or fumes are present. The presence of facial hair may make this seal difficult. 
Similarly, shoulder harnesses or seat belts that are worn from long-term use may not restrain the occupant during 
deceleration as designed. 


Access to controls 


4.6.2 Similar to the discussion of human-machine interface, the ability of a crew member to have access to 
required controls may become a factor. If a specific control is placed on the flight deck for the use of only a particular 
crew member, the other pilot may not be able to use it at all during the situation. The most common example is that the 
nose gear steering tiller is normally placed for the use by the left seat occupant alone. 


Visibility in/out of crew station 


4.6.3 Unless the pilot is surrounded by a clear canopy system, structure may inhibit visibility and the ability of the 
crew member to see on-coming traffic. Even with a full clear canopy, the area below the fuselage is usually not visible 
unless the crew makes manoeuvres in order to acquire objects below. Investigators should evaluate the crew member's 
ability to see objects if their presence is part of the accident scenario. Structure and objects placed in the field of view 
will also make acquisition of on-coming objects more difficult. In some areas of the windscreen, only one eye is able to 
detect objects outside the aircraft. Heads-up displays and instrumentation placed in the normal field of view will 
necessarily restrict visibility. See Figure IIl-4-1. 


4.6.4 In the same way, the ability of a crew member to see instruments, warning lights or switch positions across 
the cockpit may need to be evaluated. For example, an instructor pilot who requires corrective lenses for use in the 
cockpit may find instrument flight difficult in a small training aircraft if the instruments to be focused on are primarily in 
front of the student pilot. There have been cases where the seating position of the pilot not-flying has inhibited the ability 
of the crew to notice an annunciator light illumination. Sun glare can also prevent crew members from seeing objects 
outside the aircraft as well as instruments, lights and switches in the cockpit. 


4.7 FLIGHT PLANNING 


4.7.1 For many operations, a flight plan is prepared and filed with air traffic control agencies. This will provide the 
investigator with certain specific data which will require detailed examination. Additionally, in the case of commercial 
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Figure Ill-4-1. Captain design eye and ambinocular vision areas. 
Shaded areas represent structure and are not visible with either eye 
unless the captain moves from the normal design eye position. 


operations, the flight crew usually establish, with the assistance of flight operations officers, a detailed technical flight 
plan or navigation log that can be used to advantage by the investigator. A copy of this document is usually retained by 
the operator. In the case of accidents involving navigational factors or fuel consumption questions, it will be necessary to 
check technical flight plans and navigation logs and ensure that the graphical or tabulated data (or computer programme) 
from which they were derived were relevant to the particular circumstances of the intended flight, such as weather, 
aircraft type and model, cruising height, etc. 


4.7.2 Although the question rarely arises in connection with commercial flights operating a planned service, it will 
often be useful, especially in the case of light aircraft flights operated on demand and training flights, to endeavour to 
ascertain what were the crew’s intentions regarding the flight and the various manoeuvres planned. 


4.7.3 Despite the best planning, changes to routing, weather, unanticipated traffic, etc. may alter the flight profile. 
Once the flight deviates from that planned, any flight planning considerations change along with it. 


4.7.4 Flight into conditions that are beyond the qualifications and the skills of the pilot will likely result in disaster. 
While organizational planning and crew training are expected to circumvent these potentials, occasions arise where the 
result indicates a flight beyond the established limits. One of the most common examples in light aircraft accidents is 
continued flight into instrument conditions by a pilot who is not instrument-rated or in an aircraft not equipped for 
instrument flight. While the decision to continue is the primary factor, the investigator should attempt to find the rationale 
that made it an acceptable choice for the crew or supporting personnel. 
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4.8 WEIGHT AND BALANCE 


4.8.1 A weight and balance sheet based on the planned flight and weather conditions may have been prepared. 
Generally, commercial flights use a standard form for these calculations but this is rarely the case in respect of light 
aircraft. The investigator must take the following into account and produce and check this form or reconstruct it. When a 
form is not available, the investigator will have to use documentation provided by the manufacturer: 


a) most recent weighing of the aircraft; 


b) fuel and oil carried (check refuelling, testimony of fuel pump operators, fuel orders, earlier flights — 
take samples for analysis in conjunction with power plant investigation); 


c) crew and passengers carried (check manifest, tickets issued, customs or immigration documentation, 
statements of witnesses to embarkation, persons embarked or disembarked at earlier stops, 
assessment of standard weights or ascertain actual weights); 


d) cargo and loading (check manifests, customs, mail and forwarding agent’s documentation, baggage 
taken over from other flights, weight of packages salvaged, statements from persons witnessing or 
performing loading at the last airport of landing and at preceding airports, distribution among the 
various baggage compartments, etc.) 


4.8.2 Weight and balance at the time of the accident will be deduced from the above basic information according 
to the circumstances of the flight and from the distribution and weight of cargo as determined from the wreckage 
examination, together with the location and weight of passengers and crew as determined from the wreckage 
examination (including pathological examination where necessary). 


4.8.3 The setting in the cockpit and the position of the variable tailplane, or the trim tabs, if appropriate, should 
be checked against the setting and position appropriate to the calculated weight and balance of the aircraft at the 
moment of the accident. Variations from predicted setting may indicate a weight and balance shift not normally 
encountered. Fuel transfer problems and incorrect estimates of passengers or cargo mass have been implicated in 
aircraft handling difficulties or accidents stemming from a center-of-gravity outside of the aircraft limitations. 


4.9 MAPS, CHARTS AND NAVIGATION DATABASES 


4.9.1 It may be necessary to establish what maps and charts were provided for navigation purposes and to 
examine their adequacy and accuracy in relation to the navigation effort involved in the flight. This might also include an 
analysis of where the charts differ in any important respect from the Standards in Annex 4, since “uniformity” is basic to 
intelligent chart use. The limitations associated with maps of a particular nature, e.g. those specially produced for use 
with automatic radio navigation devices, should be critically examined. It may also be pertinent to examine the functional 
interrelationship of the various charts designed for different phases of the operation, where it is evident that some 
disorientation may have taken place. It may also be relevant to consider the ability of flight crews to handle the maps 
and charts provided in the confined environment of their operating positions and whether adequate lighting was available 
for their illumination. Modern aircraft show maps and charts on displays in the instrument panel along with navigation 
information from the aircraft Flight Management System (FMS) or Global Positioning System (GPS). The database for 
these systems should be inspected to determine if they are accurate and up-to-date. 


4.9.2 As appropriate to the phase of operation in which the accident occurred, the investigator should check: 
Plotting charts 


Radio navigation charts 
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Terminal area charts 

Instrument approach charts 
Aeronautical charts (topographical) 
Visual approach charts 

Landing charts 

Aerodrome charts 

Aeronautical navigation charts 
Charts from the internet 

Electronic flight bags 


RAMS and navigation aid availability 


GPS databases 
4.10 OPERATING GUIDANCE 
Flight manual 
4.10.1 The basic source of information concerning aircraft performance is the flight manual, the provision of which 


is a requirement as a Standard in Annex 6. Whilst in most cases this information will prove to be adequate for normal 
investigation purposes it may be necessary, in certain cases, to examine the data from which flight manual performance 
is determined in order to establish its validity to the particular circumstances of the accident flight. In that event a detailed 
research into the records of the appropriate airworthiness authority and the aircraft manufacturer may be necessary. The 
flight manual is usually divided into sections as follows: 


Section 1 — General 


— contains amendment records, general arrangement drawing, other dimensional data, registration 
particulars, conversion tables/graphs, definitions. 


Section 2 — Limitations 
— contains limitations of weights, fuel loading, floor loading, centre of gravity, atmospheric 
conditions (ambient air pressure and temperature), powerplant operation, airspeed and Mach 
number, crosswind (maximum velocity and direction) manoeuvres, minimum crew, maximum 
number of occupants, electrical system and auto pilot limitations, etc. 


Section 3 — Emergency procedures 


— contains essential operating procedures for emergency conditions which are foreseeable but 
unusual and demand immediate and precise action. 
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Section 4 — Normal procedures 


— includes procedures appropriate in the event of malfunctioning that are not contained in Section 3 
and should normally include the following items: 


powerplants (engines and propellers) 
fuel system 
engine lubrication system 
fire extinguisher system 
electrical systems 
hydraulic systems 
pneumatic systems 
ice protection systems 
flight direction systems 
flying control system 
automatic pilot 
procedure for severe turbulence 
pressurization system and air conditioning 
oxygen system 
— Procedures which are accepted as being part of basic airmanship will not normally be included. 
Section 5 — Performance 


— contains quantitative data relating to aircraft performance and which is normally presented in sub- 
sections in the following order: 


General 
Minimum Equipment List 
Take-off procedures and speeds 


Performance limit (Take-off Weight/Altitude/Temperature (WAT limit) as limited by climb 
requirements) 


Take-off climb gradients 


Take-off field lengths 
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Net take-off flight path data 

En-route data 

Landing procedures and speeds 

Landing performance climb limit (Landing WAT limit) 
Landing climb gradients 

Landing field lengths 


Additional special performance data 


Pilot Operating Handbook (POH), Standard Operating Procedures (SOPs) or checklists 


4.10.2 While the Pilot’s Operating Handbook (POH), Standard Operation Procedures (SOPs) or crew checklist 
should be derived directly from the flight manual, investigators should examine the references available to the crew 
when applying procedures. In abbreviating procedural guidance, checklists frequently omit clarifying information. While 
important to achieve brevity, certain details, when omitted from the checklist, may change the application timing or 
conditions when the procedural step should be considered independently. It is not adequate to assume that all clarifying 
information represented in the flight manual will be recalled during the application of an emergency procedure. 


4.10.3 Steps listed in the POH or in the SOPs should reflect directly the steps outlined in the flight manual. If 
discrepancies exist, the investigator should try to ascertain when the deviation occurred. For emergency procedures the 
difference may go unnoticed for a lengthy period — usually until the emergency procedure is applied. 


4.10.4 Investigators should be alert when coming across a procedure assigning certain steps to be implemented 
during a different phase of flight. Such procedures should have some clarifying statement in the flight manual that states 
that a step should be taken at a certain point but it should specify exactly when that step should be taken and it should 
repeat the step at the appropriate point in the checklist. For example, a DC-9 accident stemmed from the deployment of 
the air brakes prior to touchdown. This system functioned as a result of a procedure undertaken just after takeoff which 
included pulling a controlling circuit breaker. A flight manual discussion included a comment that the circuit breaker 
should be reset during taxi “after landing.” This step was included in the “Approach and Landing” phase of the checklist 
without any clarifying statement. The crew reset the circuit breaker at the time sequence for before-landing procedures 
which resulted in the air brake deployment and subsequent hard landing. 


Compliance with instructions 


4.10.5 Whilst it is not the function of an aircraft accident investigator to become involved in the disciplinary 
aspects of the enforcement of regulations and instructions, it is a necessary part of the operational investigation to 
establish whether the applicable directives were complied with. The directives should also be examined to establish 
whether, in the light of the accident, they were proper and adequate for safe operations, and whether they were 
presented in a format easily understood. In examining these matters it is important to distinguish between what material 
has mandatory effect and what is advisory. The directives may have many different forms including the following: 


National legislation 


ICAO Annexes 
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ICAO Procedures for Air Navigational Services 
Operations Manual 

Flight Manual (and SOPs) 

NOTAMs 

Aeronautical Information Publications (AIP) 
Operators instructions to flight crew 
Information Circulars 

Aircraft Manufacturers’ notices 

Airworthiness Directives 


Service Bulletins 


4.11 WITNESS INTERVIEWS 


4.11.1 The investigator should bear in mind that in some States it may be the responsibility of the police to 
interview witnesses during an accident investigation. 


4.11.2 It may be desirable because of the circumstances of the accident to form a Witness Group for locating 
witnesses and interviewing them. If such a group is formed it normally concerns itself with interviewing “eye witnesses” 
located in the vicinity of the accident. Interviewing appropriate to other groups, e.g. Structures, Operations, etc., is 
generally performed by an investigator within that group. 


4.11.3 Collecting evidence from witnesses is one of the investigator’s main tasks; information thus obtained can, if 
fact, furnish a lead as it goes hand-in-hand with the material evidence unearthed in examination of the site and the 
wreckage, and can complement it or clarify it. The investigator must not, however, overlook human fallibility, and must 
exercise great caution when analyzing statements that obviously conflict with established material evidence. The use of 
an aircraft model may often be advisable when interviewing eye witnesses. 


4.11.4 A philosophy of interview rather than interrogation is desirable in the questioning of witnesses by the 
investigator. A witness who is placed at ease, is confronted with the need for air safety and accident prevention and is 
encouraged to tell the story freely without interruption or intimidation, will normally willingly narrate the observations. 


4.11.5 The need for expert interpretation should not be underestimated whenever the investigator interviews a 
witness and the mother tongue is not common to both persons: the standard of communication may be satisfactory for 
social conversation but slight intonations in the witness’s evidence or detail which may have technical significance can 
easily be lost because of inadequate translation by the witness, the investigator, or other than an expert interpreter. 


4.11.6 If relevant to the accident, written statements should be obtained from personnel involved in the provision 
of air traffic services or flight service for the aircraft involved in the accident. This also applies to those people 
responsible for the operation and maintenance of navigation aids used by the aircraft. Efforts to locate witnesses should 
never be confined solely to the phase immediately preceding the accident but should cover all matters including not only 
the condition of the aircraft, but also human factors. Any statement that might throw light upon one single point in the 
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investigation can be important; the investigator should not be confined to locating witnesses in the immediate vicinity of 
the accident site but should seek statements relevant to the whole path of the flight, as well as from flight crew and 
passengers (and, where appropriate, their families), the operator, the manufacturer, responsible services and other 
sources. In some cases the use of powerful mass media such as the press, radio and television will assist in obtaining 
statements supplementing those already volunteered by persons coming forward or contacted by local authorities. 


4.11.7 Depending on the type of statement to be collected (information on refuelling or description of the apparent 
sequence of in-flight disintegration) or the quality of witness being interviewed (garrulous, imaginative, shocked, 
reluctant) the statement may have to be taken under varied conditions, which the investigator must evaluate. While the 
purpose of the investigation should be explained, it is not normally desirable for statements to be taken in an 
interrogatory form. 


4.11.8 The facilities at the investigator's disposal may be anything from a simple notebook, typing, stenographic 
or stenotype assistance, to portable or standard recording equipment. Suitable office accommodation or proper 
transportation may be necessary, as well as appropriate instruments and equipment for studying maps, charts and 
photographs. 


4.11.9 In connection with the determination of a probable flight path, flight tests commonly referred to as “fly-bys” 
are often employed for the purpose of refining and correlating witness observations. For example, an aircraft similar to 
the one involved in the accident can be flown on a selection of flight paths while ground witnesses, accompanied by 
investigatory personnel, observe. The witnesses are then asked to compare these flight paths with their memory of the 
one flown by the aircraft involved in the accident. Valuable information concerning probable altitude (or height, as 
applicable), course and attitude can often be derived by this means. In some accidents it may be an advantage to use a 
helicopter to determine the flight path: this method is useful where a witness can relate the position of the helicopter to a 
fixed object on the ground. A series of such observations will enable a plot to be made which will accurately reflect the 
flight path. Whenever possible, two-way radio communications between the investigator and the aircraft making the “fly- 
bys” is desirable. 


4.11.10 The following general principles should be borne in mind. 


a) Statements should be taken as soon as possible after the accident; they can always be amplified later 
if necessary, but first statements are usually the most accurate (events are still fresh in the memory 
and interpretive processes have had less time to work). 


b) It is always very useful to hear witnesses at the place where they happened to be at the time of the 
accident. This can be very helpful, not only for a clearer understanding of the statement but also for 
obtaining additional details (especially in the case of statements concerning the aircraft’s flight path 
and the accident environmental conditions). It is most helpful for the investigator to use a compass 
and inclinometer to assist in documenting accurately the eye witness observations. 


c) Itis strongly recommended that discussions with witnesses be in isolation in order to avoid influencing 
other witnesses. Also, wherever possible, witnesses should be encouraged to refrain from discussing 
their evidence amongst themselves before it has been recorded. Joint discussions can usually be 
arranged subsequently if required. 


d) No statement should be discarded out of hand. A statement from a witness experienced in aviation is 
not necessarily the most valuable, and the investigator should not overlook statements from other 
witnesses who were similarly situated. A statement from a child can be extremely useful but great care 
should be exercised in collecting and examining it. National laws concerning the taking of statements 
from persons under age should be kept in mind. 
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e) Discussions with witnesses may to a certain extent be conducted in two stages: in the first stage the 
investigator should as far as possible let the witness recount with his or her own words events as seen 
by the witness (without interruption except to keep the witness to relevant matters); in the second 
stage the investigator may need to ask questions to clear up any doubtful points or to raise others (but 
they should never be phrased in such a manner as to suggest the answers). 

f) It is a sound practice for the investigator to be accompanied by a person who can take down the 
statement or use a tape recorder to record the statement. This leaves the investigator free to 
concentrate solely on what is being said and therefore to concentrate on questions to be asked, if any. 

4.11.11 The following information should be recorded where relevant: 

— personal data regarding witness (surname, given names, employee identification number, address, 
telephone number, age, occupation, experience relevant to the statement); 

— _ time of observation (if noted, otherwise as determined in relation to other events); 

— location of witness at time of observation (pinpointed on a map if necessary); 

— anything heard or observed concerning the aircraft itself and, if relevant, other nearby aircraft 
according to the stage of flight, such as: position of flaps, trim, taxiing, run-up, brakes on start, 
initiation of rotation, climb angle, estimated speed, estimated altitude, points overflown by the aircraft, 
headings, manoeuvres, position of flight controls, landing gear, falling objects, flames from exhaust, 
fire or smoke, light signals, anti-collision and cabin lights, landing lights, touchdown point, use of 
brakes, reverse thrust, any seemingly abnormal noise, phenomena or movement, etc.; 

— _ position of the main and any scattered wreckage; 

— position of bodies (condition of seat belts, etc.); 

— _ any sketches that the witness may be able to provide to illustrate his or her statement; 

— _ any photographs or videos taken; 

— _ rescue operation reports; 

— _ if witness knows of other witnesses, their names and addresses; and 

— _ signature on one copy of the statement and of any sketches made. 

4.11.12 The investigator should record on the statement the date and place where it was taken and possibly the 


investigator's own name and capacity. 


4.11.13 


Finally, for ease of reference, the assembled evidence should be accompanied by a map indicating the 
location of each witness at the time of the accident and a key for referring back to their individual statements. 


4.12 FINAL FLIGHT PATH DETERMINATION 


The reconstruction of the last stage of the flight, i.e. the accident phase, necessitates close coordination between many 
groups of the investigation but it is the primary concern of the operations investigation. The intention should be to build 


Ill-4-14 Manual of Aircraft Accident and Incident Investigation 





up a complete picture of the final events as they occurred and in proper sequence and evaluate their interrelationship. 
The period of time to be covered will depend upon the circumstances; in general terms it should commence at a stage 
where the flight departs from normal safe operation and it can terminate when the inevitability of the accident is 
indisputably apparent. This need not necessarily be the time of crash impact, for example in the case of a structural 
failure in cruising flight, once the wings have broken off, the accident is inevitable; similarly, in an unrecoverable “jet- 
upset” situation, once the aircraft is too low to regain a normal attitude without grossly exceeding many limitations the 
accident is bound to follow. In take-off and landing accidents, however, the crash impact will be the terminating event 
and it may be necessary to use this as the starting point of the reconstruction and work backwards for the purpose of 
synchronizing the various sources of information which may have been established on a sequential basis by other 
investigation groups. The flight recorder investigation will provide the basis of the reconstruction and the radiotelephony 
recording will provide the necessary link with related activities on the ground. The structures investigation should be able 
to determine the aircraft configuration and the human factors investigation may add to that evidence. It may also 
establish certain important considerations regarding the condition or operating efficiency of the flight crew. The 
powerplants investigation should be able to indicate the degree of engine power being developed at the time of impact 
and the systems investigation should be able to contribute to the aircraft configuration determination in some detail. 
Finally the reconstruction should be considered in the environment indicated from an evaluation of all the witnesses’ 
statements and in the meteorological conditions determined by the weather investigation. 


4.13 SEQUENCE OF FLIGHT 


4.13.1 The enumeration of the above information (Sections 4.2 to 4.12 above) should bring to light the items of 
importance in the operations investigation in relation to the other areas of accident investigation. Indeed, the synthesis of 
all the data obtained by the operations investigation is the main contribution to any flight reconstruction. It may also 
happen that the particular characteristics of the accident necessitate not only the reconstruction of the accident flight but 
other previous flights. 


4.13.2 Although the investigation will have to devote particular attention to the phase in which the accident 
occurred (see Section 4.12 above) it will usually be desirable to discuss the development of the entire flight. Moreover, in 
many cases, the investigator will find it advantageous to conduct an overall review of every major area of the operations 
investigation covering each part of the flight. For example, during the en-route phase, such areas as the flight crew, air 
traffic services, weather, flight planning, aircraft performance and witnesses’ statements will all furnish specific 
information related to the en-route phase which may need to be developed depending upon the nature of the accident. 


4.13.3 The data contained in the aircraft flight recorders and radar records can often be used to rapidly develop a 
computer generation of the flight path, linked to crew actions and support personnel instructions. This can assist in the 
identification of when and where the flight deviated from its planned course, or at what point the manoeuvres exceeded 
the limits of the aircraft structure or the limits of human physiology. 


Chapter 5 


AIRCRAFT OPERATING ENVIRONMENT 


5.1 INVESTIGATION OF METEOROLOGICAL CONDITIONS 


5.1.1 Despite technological advances in weather forecasting, dissemination and presentation of weather related 
meteorological (MET) data, MET conditions continue to be identified as a contributing factor in aviation occurrences 
worldwide. Therefore, an accident investigation in which MET conditions are an important contributing factor will benefit 
from the formation of a separate group which includes qualified personnel with specialized training in meteorology. 
Where a separate group is not considered appropriate, it may be appropriate to request a specialist meteorological 
report from a qualified (and non-involved) meteorologist. Whether or not this course of action is taken, the following 
matters will need to be considered. 


Collection of meteorological data 

5.1.2 Exact MET products and data collected will vary from State to State, due to availability of data (i.e. sparse 
in remote areas) and the complexity of the MET phenomena associated with the occurrence. However, there are a 
number of observation and forecast data that should be collected. It is recommended that data be collected for a period 
of 12 hours preceding an occurrence and a few hours following the occurrence to aid in identification of trends and 
analysis of continuity. ' It is essential that both the forecast and observed MET conditions be accurately documented. 
5.1.3 Given the increase in multi-institutional, cooperative meteorological research projects and the reliance of 
private institutions on MET data, there are many sources of data to be considered during an investigation. These data 
sources include:** 

a) State’s meteorological services; 

b) civil aviation services; 

c) military weather services; 

d) private weather companies; 


e) universities; 


f) TV and radio stations; 





1. If applicable, data should be collected and analyzed pertaining to MET conditions faced by surviving occupants and Search and 
Rescue (SAR) missions. 

2. Bureau Enquétes Accidents (de France), (1995). Weather: Chapter 3 — Operations investigation. In Manual of aircraft accident 
investigation. Draft submission to the ICAO Accident Investigation Methodology Study Group — Memorandum No. 26. Montreal, 
Canada: ICAO. 

3. National Transportation Safety Board (NTSB), (2002) Appendix H - Group chairmen checklists. In Aviation investigation manual - 
Major team investigations. Washington, DC. 
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g) utility companies; 

h) agricultural sites; 

i) MET research centres; 

j) MET operational tests; 

k) air quality monitoring networks; 
l) internet sites, webcams; 

m) video recordings; 


n) witness testimonies (ground and airborne), and air accident investigation services (FDR and CVR 
read-out and analysis); and 


©) surviving aircrew or passenger statements. 


Observations 


5.1.4 The actual MET conditions prevailing at the time and location of the accident and, if pertinent, along the 
route may be derived from a variety of data such as: 


a) routine and special aerodrome meteorological reports;4 
b) sea state and buoy data; 

c) surface MET observations; 

d) precipitation records; 

e) barograph records; 

f) wind records; 

g) ceilometer records; 

h) RVR records reports on the state of runway; 

i) | Synoptic surface charts/ Streamline Analysis charts; 
j) | camera images/video recordings, web cameras; 

k) upper air charts of pressure, wind and temperature; 


1) thickness, vorticity and vertical velocity charts; 





4. Data relating to the location of observation stations and meteorological sensors should be gathered. 
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m) upper air observations; 

n) stability indices analysis charts; 

©) routine and special aircraft reports (AIREPs (PIREPs in North America)); 
p) meteorological RADAR data (i.e. precipitation and Doppler wind data); 
q) MET satellite images/data; 

r) lightning data; 

s) recordings (i.e. VOLMET broadcasts, ATIS, CVR, FDR data); 

t) conditions of natural light (i.e. twilight, moonlight); and 

u) data from Low Level Windshear Alert Systems. 


5.1.5 In addition, valuable information may often be derived from local meteorological station observations, other 
aircraft in flight, witnesses’ statements or expert examination of the wreckage (hail damage, ice accumulation, etc.) 


5.1.6 In various States, Aeronautical Meteorological Personnel are required to make special MET observations 
whenever they are aware that an accident is likely to occur or has occurred on the aerodrome or in its immediate 
vicinity.° The investigator should pay particular attention to such special observations when available. 

5.1.7 The selection of observational data to be collected and reviewed will be dependent upon the 
circumstances of the occurrence being investigated. It is most desirable that the investigation examine the original rather 
than copies of the recorded observational data. 


Forecasts 


5.1.8 The forecasts of MET conditions pertinent to the accident should be documented. Dependent upon the 
nature of the occurrence, some or all of the following types of forecasts may require review: 


a) aerodrome forecasts (TAFs and amended TAFs); 

b) forecasts of area QNH (if applicable); 

c) marine forecasts; 

d) forecasts of upper-air pressure, temperature and wind; 

e) forecasts of MET conditions at surface/Gradient Wind Streamline (if applicable); 
f) meteorological warnings (including civil/public); 


g) SIGWX forecasts; 





5. It is desirable that such standing arrangements be made in anticipation of an accident occurring. 
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h) Volcanic Ash and Tropical Cyclone Advisory information; 

i) | forecasts of thickness vorticity and vertical velocity; 

j) forecasts of stability indices; 

k) forecasts of icing; 

|) forecasts of turbulence; 

m) AIRMET; 

n) SIGMET; 

0) GAMET; and 

p) aerodrome and wind shear warnings. 
5.1.9 In connection with SIGWX forecasts, special attention should be paid to any SIGMET information 
messages (information on the occurrence or expected occurrence of specified hazardous en-route MET phenomena 
such as thunderstorm, severe turbulence, wind shear) which may have been issued and which would have been 
applicable to any part of the flight. 

Briefing and flight documentation 
5.1.10 A copy of any MET and aeronautical documentation covering the flight should be obtained for study. 
Particular attention should be paid to the currency and accuracy of all such operational information that was requested 
by and/or provided to the flight crew in the preflight preparation and during the flight. 
5.1.11 Statements should be obtained from personnel who supplied any operational information to the crew both 
prior to departure and while en-route. Emphasis should be placed upon determining whether the crew was adequately 
informed regarding hazardous MET conditions. 
Post-flight analysis 
5.1.12 An assessment should be obtained from a qualified (and non-involved) meteorologist of the MET 
conditions throughout the flight resulting from an analysis of all the MET information brought to light in the investigation. 
Careful consideration should be given to the possibility that hazardous phenomena may have been present which were 
not readily apparent from the forecasts and observations available at the relevant time, particularly in the case of en- 
route occurrences involving structural failure. Such phenomena might include mountain wave effects, tropical cyclones, 
severe turbulence, freezing rain, volcanic ash, etc. Where the weather is considered to be a contributing factor, 
specialist plotting of a cross sectional flight profile should be obtained. 
Adequacy of service 

5.1.13 Emphasis should be placed upon determining whether the crew was adequately informed regarding 


hazardous MET conditions. The observing, forecasting and briefing facilities involved and the services provided should 
be examined with a view to determining whether: 
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a) pertinent regulations and procedures were satisfactory, available, and adhered to;® 
b) disparities existed between workload and staffing; 


c) forecasts and briefings were accurate and made effective use of all known and relevant information; 
and 


d) communication of information to the relevant aeronautical personnel was accomplished without delay 
and in accordance with prescribed procedures. 


Adequacy of flight documentation and messages 


5.1.14 In particular, localized, frequently observed MET phenomena at an aerodrome may be listed in flight 
supplements as a warning to aircraft. These flight supplements are often used for flight in visual meteorological 
conditions (VMC). However, these same warnings may not be included in documents relating to flight in instrument 
meteorological conditions (IMC) for the same aerodrome. Therefore, comparison of such documents should be made so 
as to highlight possible disparities. As an example, a flight supplement for an aerodrome surrounded by rough terrain 
with frequently strong winds may warn of possible mechanical turbulence. However, this warning may not be in 
approach plates used in IMC. In addition, investigators must also consider the possibility that frequent use of these 
particular aerodromes may breed complacency and thus the exclusion of such information. 


5.1.15 Aside from flight documentation, consideration to messages in flight must also be given. For instance, most 
pilots receive SIGMETs via radio and thus lack a hard copy for thorough analysis. Such data should be examined for 
clarity and brevity and whether they facilitated understanding and use of messages given conditions of flight. In addition, 
there are possible limitations to reports (e.g., AIREPs/PIREPs). These limitations are particularly relevant to reports of 
icing and turbulence, given that their interpretation is subjective. 


Operating norms and policy 


5.1.16 Norms, whether organizational, group or individual may significantly influence behaviour and operations. In 
relation to MET conditions, an investigator should analyse the various organizations, groups and norms of the aircrew (if 
possible). Particular attention should be paid to norms and policies relating to the dissemination of information, and 
analysis of data, for instance, a possible norm of pilots failing to read dispatch reports in their entirety due to their 
considerable length. This norm of seeking only certain data may have restricted the comprehensiveness of weather 
briefings provided. 


5.1.17 Regulatory body’s and operator’s operational policies regarding flight in hazardous weather conditions and 
the operational reality should be analysed for disparity. Such analysis may also be applied to industry norms (e.g. 
penetration of thunderstorms in terminal areas).’ The forecast and observed MET conditions should be compared to any 
limitations on aircraft or aircrew, including regulatory and company policies. 





6. It should be noted that there can be limitations to reporting regulations. Further, disparities can exist between aeronautical and 
civil/public severe weather warnings that could be a causal factor. 

7. Rhoda, D. A., & Pawlak, M. L. (1999). An assessment of thunderstorm penetrations and deviations by commercial aircraft in the 
terminal area. (Project Report NASA/A-2). Springfield, VA: NTIS. 
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Availability of data 
5.1.18 Each investigation will differ in relation to the availability of data. This may be a result of scarce reports in 
remote areas and inadequate data collection networks. There may also be limitations of technology used to collect, 
display and disseminate data. In such cases an investigator may be forced to utilize considerable innovation in analysis 
techniques and tools. In such situations, it may be useful to consult various colleagues, experts and researchers in these 
areas. It is also advisable to look for information and advice from the various existing and available sources of MET 
information (WAFCs, VAACs, TCACs, MWOs, etc.). 
Collection of occurrence particulars 
5.1.19 Important data must be collected (e.g. time of occurrence, route) to facilitate or complement collection of 
MET information. For instance, it is obvious that the date and time of an occurrence must be known to gather correct 
data. Primary sources of such data shall be obtained from flight plans, Air Traffic Services (ATS) radar data, navigation 
and topographical charts. Data collected should include: 
a) occurrence date (UTC and LMT); 
b) occurrence time (UTC and LMT); 
c) occurrence location; 
1) general location; 
2) grid reference; and 
3) elevation and topography; 
d) departure point; 
e) cruising altitude or flight level; 


f) destination and intermediate stops (with ETAs/ATAs and ETDs/ATDs); and 


g) radar tracks. 


Collection of technical data 


5.1.20 Collection of technical data may include the breakdown and testing of MET instrumentation and 
collaboration with other groups to gather data on aircraft instruments (e.g. altimeter). Data should also be collected with 
regards to the State’s, operator's, and ATS’ tools, (e.g. radar technology, high-resolution satellite imagery, numerical 
weather prediction (NWP) models). 


Collection of human factors data 


5.1.21 Human factors data, from a MET standpoint, should be collected to gain not only insight into aircrew 
decision making but also organizational oversight and omissions that may have contributed to the occurrence. 
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5.1.22 Copies of any MET documentation covering the flight should be obtained for study. Particular attention 
should be paid to all MET information that was requested by and/or provided to the flight crew in the pre-flight 
preparation and during the flight. In addition, statements from personnel who supplied MET information to the crew both 
prior to departure, whilst en-route, and at the destination (if applicable) should be obtained, with emphasis on the 
acknowledgement by the crew of the existence of forecast hazardous MET conditions. 


5.1.23 Statements of personnel and documentation relating to the coordination and dissemination of MET data 
should be collected. Such data, both intra- and inter-organizational, should be collected from organizations such as the 
appropriate ATS agency, the State’s weather service, and the aircraft operator (e.g. airline, flight school). In addition, 
data relating to staffing levels and personnel’s workload, for all organizations, should also be collected if applicable. 


5.1.24 Statements from the operator and documentation relating to MET training of the aircrew should be 
collected. Data relating to the operator’s operational policy in relation to flying in hazardous MET conditions should also 
be collected. Additionally, data regarding norms (unwritten expected practices) relating to the type of MET products used 
by the operator’s aircrews and dispatchers should be collected. For instance is it regular practice to analyse satellite 
imagery? Data relating to aircrew norms for analysing dispatch reports should also be collected. 


Analysis of data 


5.1.25 An analysis of all data collected should be made by a qualified (and non-involved) person with specialized 
meteorology training, and with, in some instances, other groups (e.g. human factors/numan performance). Careful 
consideration should be given to the possibility that hazardous phenomena may have been present which were not 
readily apparent from forecasts and observations available at the relevant time. Such phenomena might include 
tornadoes, severe turbulence, freezing rain, low-level wind shear and volcanic ash. Analysis should also examine 
technical equipment and human factors data for possible influences. 


Analysis of occurrence particulars 


5.1.26 It is imperative that an analysis of the accident particulars precedes the analysis of MET conditions. For 
instance, information regarding the elevation will be required for the calculation of pressure altitude®, and knowledge of 
location and terrain will aid in the analysis of possible local weather effects. Data on natural light conditions combined 
with the occurrence date and time will aid the possible identification of local winds (e.g. land/sea breeze, katabatic 
winds). Further, comparing flight plan data against radar tracks may provide clues to conditions faced by aircrews. The 
meteorology group may benefit from collaboration with the performance group on aspects such as aircraft speeds, which 
again may point to conditions faced by aircrews. For instance, a low aircraft ground speed (GS) despite a tailwind 
component may point to the crew slowing to the turbulent penetration speed (Vg) providing a possible indication of 
significantly turbulent flight conditions. 


Analysis per phase of flight 


5.1.27 Following the analysis of all the data collected, understanding of the atmosphere must be related to each 
phase of flight, namely: 


a) taxi, takeoff to top of climb; 





8. ‘Pressure altitude’ is the term most often used internationally; however, in some States the term ‘pressure height’ is used. It should 
be noted that these terms are synonymous. 
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b) en-route data; and 


c) top of descent, approach, landing, and taxi. This method, in large measure, should provide the 
investigator with considerable physical understanding of the atmospheric conditions during different 
phases of the flight. 


Analysis of technical data 


5.1.28 There are many items which may have restricted the accuracy and comprehensiveness of meteorological 
data provided to aircrews, State weather agencies, ATS units, and operators. 


5.1.29 If the accuracy of MET information is suspect, investigators may break down and test MET instrumentation. 
In winter, consideration should also be given to the possibility of ice accretion on MET instrumentation. For instance, 
during periods of freezing precipitation, ice accretion may reduce the efficiency or cause complete failure of 
anemometers, thus restricting the validity of wind data. These same considerations may be applied to aircraft 
instrumentation. In such cases, weather investigators may benefit from collaboration with other groups. 


5.1.30 Technology for gathering and displaying MET information may vary from State to State and thus 
examination of the capabilities and limitations of such tools (e.g. radar technology, high-resolution zoom satellite imagery) 
should be analysed. Consideration must also be given to possible limitations of technology as a result of atmospheric 
phenomena, for instance, aircrews flying into thunderstorms, and areas of hail, as a result of false radar returns caused 
by radar attenuation due to absorption. 


5.1.31 Weather forecasting has seen a general improvement aided largely by greater NWP model accuracy and 
by the availability of World Area Forecast System (WAFs) forecasts globally. Despite this improvement, model limitations 
possibly restricting the accuracy of forecasts must be considered. 


Analysis of human factors data 


5.1.32 Comparison of forecast conditions, aircrew actions, and the investigator's identification of possible hazards 
may suggest possible issues with aircrew judgement. However, simply stating that the pilots flew into adverse MET 
conditions does little to explain why. The investigator, together with the human factors/performance group, must 
endeavour to identify why the aircrew’s decisions made sense to them at the time. There are a number of human factors 
barriers to effective aircrew weather decision making. Such barriers may include lack of knowledge due to inadequate 
training or poor provision of MET information, and operating norms. 


5.1.33 The overall process of occurrence investigation within the human factors field is similar across many 
methodologies. However, differences arise in their particular emphasis of the techniques. Whilst some focus on 
management and organizational oversights and omissions, others consider human performance/error problems (on the 
frontline) in more depth’. Both levels must be examined to permit a comprehensive analysis. 





9. Livingston, A.D., Jackson, G., and Priestley, K. (2001). Root causes analysis: Literature review. Suffolk, UK: HSE Books. 
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5.2 INVESTIGATION OF AIR TRAFFIC SERVICES 


5.2.1. General 


5.2.1 It may be desirable because of the circumstances associated with the occurrence to form a separate air 
traffic services group which includes an air traffic services specialist investigator. Where a State does not employ or 
have access to an air traffic services specialist investigator, an experienced (and non-involved) air traffic services officer 
may be considered to provide specialist advice and assist the investigator-in-charge to investigate all aspects of air 
traffic services in relation to the occurrence. It may be convenient and practicable to include other related areas such as 
communications, aerodrome facilities, and navigation (in so far as the latter is concerned with ground equipment) within 
the sphere of the investigation to be conducted. In preparation of the final report, relevant factual information derived 
from the air traffic services investigation may be inserted into the applicable section(s) as appropriate. 


5.2.2 Air traffic services has, as its objectives, the prevention of collisions between aircraft, preventing collisions 
between aircraft and obstructions on the manoeuvring area, expediting and maintaining an orderly flow of air traffic, 
providing information useful for the safe and efficient conduct of flights, and notifying appropriate organizations of aircraft 
in need of search and rescue aid. Where appropriate, the investigation should address all aeronautical and operational 
information services obtained from, and/or delivered by, service providers. 


5.2.3 Detailed event transactions and detailed event reconstruction should provide evidence to verify progress of 
the flight from the planning stage, through the various functions exercised by the relevant air traffic service providers, e.g. 
ground control, aerodrome control, departure control, area (or air route) control, and approach control, to the occurrence. 
In some circumstances it may be necessary to continue the investigation beyond the actual occurrence, e.g. in the case 
of search and rescue actions, or in-flight emergencies involving air traffic services. The air traffic service investigation 
should consider the use of simulators, computer graphics and video facilities, wherever possible, in the occurrence 
reconstruction. 


5.2.4 It may be necessary to investigate the efficiency and effectiveness of the air traffic service, particularly in 


an occurrence involving aircraft proximity violations in the air or on the manoeuvring area. In this event the following 
aspects should be considered and closely examined: 


a) _ siting of and visibility from the control tower; 

b) adequacy of accommodation of associated ATS centres and units; 

c) ATS personnel, including appropriate number, qualifications (licenses) and supervision of personnel; 
d) work and rest schedules of ATS personnel; 


e) adequacy of specified procedures and practices including the provision of separation minima 
depending on the approval status of the aircraft in RVSM airspace; and 


f) adequacy of equipment including ATS surveillance systems, signal lights, binoculars and anti-glare 
devices. 


5.2.5 Determination of the precise time of the occurrence is important. It is likely that the first indication of the 
approximate time of the occurrence will be obtained from the air traffic service centres and units in communication with 
the flight. When the transcripts of the radiotelephony communication recordings become available it is usually possible 
to establish within about one minute the time of the occurrence. Sometimes greater accuracy is possible. If the aircraft 
was fitted with equipment such as a flight data recorder, a voice recorder or automatic dependent surveillance 
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equipment it will normally be possible to narrow down the occurrence time to within one or two seconds. It is of 
importance to determine the time period to be examined by the investigation as this will define the extent of data, 
records and personnel involvement. 


5.2.6 In the event of an occurrence involving flight into terrain, the recordings of a seismometer, located 
sufficiently close to the occurrence site to detect the impact, may be available to establish the time of the occurrence 
with great accuracy. Every effort should be made to determine as precisely as possible the time of an occurrence in 
order to be able to make use of information derived from the synchronization of recorders with the time base of the 
radiotelephony recording. 


5.2.7 The air traffic services specialist group shall take into consideration that the evolution of the air transport 
industry, associated with the evolution in the ATM systems and concepts may represent a challenge for investigation 
purposes, considering that sometimes the responsibility for the provision of determined service will change, according to 
the contract for provision of the particular service, e.g. separation, that will be updated during the real time operations. 


5.2.8 With the evolution of the ATM systems and concepts, complexity will be also added to the whole system, 
and an investigation process will need to verify quite closely the service delivery management to define the correct 
actors of a determined occurrence and in this case all the ATM community could be involved taking into account that any 
participant of the ATM community may have had an important participation in a process that ended in an occurrence and 
this will add complexity to the investigation process. 


5.2.9 More and more the ATM system is gaining complexity. The traditional methods of science and analytical 
philosophy are not sensitive enough to the dynamics of complex ATM systems. Analytical methods, deductive logic, 
formal rule-based procedures and closed algorithms may not be sufficient to complete an occurrence investigation. A 
connectionist approach will be necessary, because this approach is intrinsically more sensitive to the complexity of the 
ATM system envisaged by the Global ATM Operational Concept. Some key characteristics that will contribute to the 
complexity of the ATM system will be its distributedness, self-organization and the operation on local information without 
central control. 


5.2.10 On the other hand, the availability of a system-wide information management will help the data collection 
necessary for the investigation. 

Personnel histories 
5.2.11 A study of all the facts pertaining to the air traffic services forms an important part of the air traffic service 
investigation and may also be relevant to specific operations and human factors investigations. Because these aspects 
are closely related, a high degree of co-ordination in the collection and evaluation of the relevant facts is required to 
achieve the best possible use of the information collected. 


Personal record 


5.2.12 The following personal information should be obtained in respect of each air traffic service officer involved 
in the occurrence: 


a) full name; 
b) contact address and telephone numbers; 


c) date of birth; 
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d) type of air traffic services license/certificate; 

e) total length of service; 

f) length of continuous service at relevant location; 

g) ratings held and dates obtained; 

h) operating position occupied at the time of the occurrence; 
i) proficiency check records; 


j) medical history (recent illness, last medical examination, investigation of fatigue factor including an 
assessment of duty time and rest time within the 28 days preceding the occurrence and particularly 
within the last week and last 72 hours); 


k) _ initial and continuation training (including assessments); and 
1) use of corrective and/or anti-glare lenses. 


5.2.13 In order to gather this information, the investigator may have to obtain a number of statements (possibly 
from other air traffic service officers who have worked with the person concerned), and make particular use of previous 
relevant air traffic service recording data relating to earlier flights, as well as readout of on board flight data recorded 
during preceding flight stages. The extent to which any of the above information is required will depend on the particular 
nature of the occurrence under investigation. 


Activity before, during and after the occurrence 


5.2.14 The evaluation of the air traffic services personnel activities should be done in the same way as the 
evaluation of the personnel activities in the operations and human factors investigations. The following should be 
considered: 


a) Before the occurrence. The air traffic services investigation should examine specifically: 


1) activities within the 72 hours prior to the occurrence with particular reference to psychological 
factors that might have a bearing on the performance of the relevant air traffic services personnel, 
their physical condition in relation to the work/rest cycle and meal irregularity and an assessment 
of their sleep patterns; 


2) circumstances such as distance travelled in the journey to the location of the air traffic services 
centres and units including preparation activity prior to commencing duty; and 


3) the activities and workload since commencing duty at the workstation. This information can 
usually be obtained and substantiated from statement and/or hard copy and/or electronic data 
recordings; 


b) During the occurrence. In the light of the information obtained above, the investigation should 
endeavour to reconstruct the role, workload and behaviour of each of the relevant air traffic services 
personnel during the sequential phases of the occurrence itself. It may also be relevant to examine, in 
conjunction with the human factors group, the contribution made by such factors as the workstation 
layout, the operating environment, flight progress display, facilities presentation and controls, etc.; and 
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c) After the occurrence. The role of the air traffic service investigation and the information useful for the 
conduct of the investigation may not be limited to establishing the history of the flight and of the 
occurrence. The activities of the air traffic services personnel immediately following the occurrence 
such as the organization of search and rescue where relevant, relief from operational duty, etc. should 
be evaluated. 


Flight planning 

5.2.15 For many operations, a flight plan is prepared and filed with air traffic service units. This will provide the air 
traffic service investigation with certain specific data which will require detailed examination. Additionally, in the case of 
commercial operations, the flight crew usually establish, with the assistance of flight operations officers, a detailed flight 
plan or navigation log that can be used to advantage by the investigation. A copy of this document is usually retained by 
the operator. In the case of occurrences involving navigation or aircraft performance factors, it will be necessary to check 
flight plans and navigation logs and ensure that the graphical or tabulated data (or computer programme) from which 
they were derived were relevant to the particular circumstances of the intended flight, such as weather, aircraft type and 
model and cruising height. 

5.2.16 Although the question rarely arises in connection with commercial flights operating a planned service, it will 
often be useful, especially in the case of light aircraft flights operated on demand and training flights, to endeavour to 


ascertain the crew's intentions regarding the flight and the various manoeuvres planned. 


5.2.17 Where it is necessary to investigate the efficiency and effectiveness of the flight planning processes, the 
following aspects should be considered: 


a) _ flight planning requirements; 
b) flight plan submission, type and content; 
c) operation planned; and 


d) operational information obtained/provided. 


Airways facilities 

5.2.18 The air traffic services investigation should also address and report upon all factual information relating to 
the operational status and serviceability of the airways facilities in the period before, during, and after the occurrence. In 
doing so, the air traffic services investigation should establish, record and verify the accuracy of all relevant information 
by use of a checklist. Some or all of the following items may be relevant depending upon the relevant airways facilities 
and technology status: 

a) aeronautical information processing; 

b) meteorological information displays; 

c) surveillance data processing; 


d) flight data processing; 


e) local and wide area data processing; 
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f) aeronautical fixed telecommunications network; 

g) aeronautical telecommunications network; 

h) aeromobile ground/air/ground voice communication and data links; 
i)  inter- and intra-unit voice communication and data links; 

j) local and remote facility monitoring and status register; 

k) dynamic air route planning and processing; 

1) satellite navigation and communications; 

m) conflict/collision probe and avoidance; and 


n) facility diagrams, drawings and operator notes. 


Communications facilities, procedures and phraseology 


5.2.19 Communications facilities utilized by air traffic services (and these may vary with the characteristics of the 
sector entered by aircraft) are either recorded or reported in listening logs by the services concerned. However, the air 
traffic services investigation must not overlook the possibility of obtaining further communications evidence from other 
sources such as the aircraft flight data and cockpit voice recorders, other aircraft whether on the ground or in flight 
and/or other civil and/or military ground stations listening on the same frequency(ies). Furthermore, when appropriate, all 
voice and data link communications on the operator's communication network should also be investigated including 
commercial providers of aeronautical communications information. 


5.2.20 Analogue and digital recorders are provided by most States for ATS centres and units. Recordings may 
cover not only air-ground voice and data link communications, but also voice, radio, satellite and land line 
communications between the various ground services or stations (aircraft movement and control coordination 
exchanges, exchanges between ATS and meteorological officers, fire-fighting vehicles, etc.). Recorders may be either 
“audio activated” (economical on recording medium which runs only during message transmission, but chronology may 
in some cases be somewhat difficult to review because opening syllables may be obscured) or “continuous” (high 
demand on recording medium which runs even between messages, but chronology can be easily reviewed with 
continuity of time normally also available). 


5.2.21 With either kind, simultaneous multi-track recorders allow for the input of synchronized time signals in any 
of a number of forms (hook-up with a talking clock provided as an accessory to the recording machine or for other 
purposes: coded or plain language time signals). This provides an exact chronological reference datum as the 
recordings on the different tracks are naturally synchronized. National regulations governing the preservation of such 
recordings vary somewhat, the minimum period being in the order of 30 days. It is desirable, however, for the air traffic 
services investigation to ensure as early as possible in the investigation — preferably by prescribed standard operating 
procedures to cover the possibility of an occurrence — that all recordings likely to be associated with the flight are 
removed from the normal day-to-day system and placed in safe-keeping pending instructions. It is also highly desirable 
that any transcript of the relevant recordings be performed under the supervision of a member of the air traffic services 
investigating team (in respect of security, these comments also apply to all documents associated with the flight). A 
useful technique may be to develop a sequence time line of communications events originating from both aeromobile 
and ground stations, including intercommunications exchanges. 
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5.2.22 Where such recordings exist, they represent a very important source of information for the air traffic 
services investigation. The read-outs are, as a rule, fairly easy but call for certain essential precautions: 


a) extreme care must he exercised in handling and storing master records (the risk of deterioration or 
obliteration must always be borne in mind); 


b) a wise precaution is to make, wherever possible, one or more copies of the master record and to use 
these copies for most of the playbacks when it is not essential to use the original recording; 


c) in reconstructing the timing for all documentation, the same reference datum must naturally be used 
throughout, and the air traffic services investigation will therefore be responsible for fixing the datum 
point and establishing any differences between times quoted or used in the recordings from various 
sources; and 


d) it will be necessary to synchronize all communications recording time datum with that on the flight 
recorders from the aircraft. 


5.2.23 The transcripts of the readouts are likely to be used by persons who have not listened to the tapes which, 
moreover, may come from various air traffic service centres and/or units; certain specific data should therefore be 
provided with each transcript and a uniform presentation should be adopted: 


a) an introductory page should indicate the origin of the recording, the frequency or frequencies 
recorded, the period covered by the transcript, reason for making that transcript, persons responsible 
for it and where and when it was made (possibly the location of the master records); and 

b) each succeeding page may contain at least the following columns: 

1) _ time indications; 

2) sending stations; 

3) receiving stations; 

4) material which was read out without difficulty; 
5) doubtful or unintelligible material; and 


6) remarks of the person(s) responsible for the transcript. 


5.2.24 For ease of reference, the air traffic services investigator may find it useful to underline in the text of the 
message the word or words spoken at the moment of each time signal. 


5.2.25 The air traffic services investigation should also address and report upon all factual information relating to 
the operational status, performance and serviceability of the communications facilities, including standard operating 
communications procedures and phraseology for a period relevant to the occurrence. By carefully noting the quality of 
the communications, the air traffic services investigation may make further analysis of the communications to determine 
other useful aspects for the investigation or for forwarding to the operations group. For example it may be possible to 
determine microphone sources, meteorological phenomena (rain, lightning, static, etc.), background noise, interference 
via spectrographic analysis and particular individuals’ levels of anxiety by change in voice and/or pitch/tone. Calculation 
of line-of-sight relative to aircraft and transmitter/receivers may also provide useful range information. Journalization or 
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expectation errors (readback/hearback) by aircrew and air traffic services personnel should also be examined as 
contributing causal factors. Dependent upon the nature of the occurrence, some or all of the following items may be 
relevant to communications aspects: 

a) air-ground-air in use (VHF, UHF, HF, data link, etc.); 

b) air-ground-air outlet sites, elevations, networks, configuration aid coverage diagrams; 

c) terrestrial and satellite controlled intercommunications; 

d) calibration of ATS equipment; 

e) frequencies and propagation characteristics; 

f) telephony and microphone techniques; 

g) calling, replying and acknowledgment standard operating procedures; 


h) unit/service identification; 


i) clear, unambiguous standard operating procedural words, phrases and language used _ in 
communications; and 


j) | readback/hearback errors or omissions. 


Navigation 

5.2.26 Where relevant, the navigation aspects of an investigation may be of concern to the air traffic services 
investigation. The navigation capabilities or equipment notified as carried in the aircraft should be checked against the 
aircraft records. The navigation facilities may comprise terrestrial components such as NDBs, VOR, DME, ILS, LORAN, 
ATS surveillance systems equipment and space-based GNSS and its augmentation. The air traffic service investigation 
should also investigate the navigation aspects of an occurrence involving aircraft equipped with sole-means global 
positioning sourced navigation systems. 
The following features should be considered in respect of each terrestrial navigation facility examined: 

a) location (geographic co-ordinates); 

b) identification signal; 

c) power output and supply; 

d) monitoring and warning system(s); 

e) equipment calibration and radiation pattern; 

f) operating and maintenance schedules, and their notification (AIP, NOTAMs); 


g) normal level of performance; 


h) _ interference(s); 
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i) past complaints, interruptions and failures (crew, operation, etc.); and 

j) | statements from relevant personnel including other aircrew who used these aids. 
5.2.27 When navigation information is obtained through GNSS, the investigation will need to rely on recorded 
GNSS information both for the augmentation system and for the GNSS core system constellation used for the operation. 
The parameters to be recorded are dependent on the type of operation, augmentation system and core elements used. 
All parameters available to users within a given service area should be recorded at representative locations in the 


service area. 


5.2.28 For GNSS core constellations, a recording of the following monitored items should be available for all 
satellites in view: 


a) observed satellite carrier-to-noise density (C/N.); 

b) observed satellite raw pseudo-range code and carrier phase measurements; 
c) broadcast satellite navigation messages, for all satellites in view; and 

d) relevant recording receiver status information. 


5.2.29 For SBAS, the following monitored items should be recorded for all geostationary satellites in view in 
addition to the GNSS core system monitored items listed above: 


a) observed geostationary satellite carrier-to-noise density (C/N.); 

b) observed geostationary satellite raw pseudo-range code and carrier phase measurements; 
c) broadcast SBAS data messages; and 

d) relevant receiver status information. 


5.2.30 For GBAS, the following monitored items should be recorded in addition to the GNSS core system and 
SBAS monitored items listed above (where appropriate): 


a) VDB power level; 

b) DB status information; and 

c) broadcast GBAS data messages. 
5.2.31 When there is any reason to suspect that a navigation aid may be involved as a causal factor, the air traffic 
services investigation should request, without delay, special ground and flight checks. Standardized checks should be 
prescribed by States and performed on navigation aids if they were being used, or if there is any possibility that they 


were being used, by an aircraft involved in an air safety occurrence. 


5.2.32 In addition to reviewing the result of special ground and in-flight checks, the investigation should study the 
records of former routine checks (site evaluation, commissioning and recent periodic checks). 


5.2.33 Attention should be drawn to the value of the checks in regard to possible differences between the state of 
the equipment used at the time of the occurrence and the state of the equipment at the time of ground or in-flight check. 
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Aerodrome facilities 

5.2.34 Where it is relevant to the particular occurrence, the air traffic services investigation may have to examine 
and verify the status of many aerodrome facilities used by or available to the aircraft involved in the occurrence. 
Amongst the items that may need to be checked and verified are the following: 

a) characteristics of the runway(s) in use; 

b) characteristics of the movement areas; 

c) surrounding terrain, obstructions and meteorology characteristics; 

d) aerodrome diagrams; 

e) lighting and guidance signage; 

f) electronic surface movement detection systems; 

g) standard, contingency and emergency operating procedures; 

h) visual and electronic navigation aids; 

i) | communications networks; 


j) environmental conditions; and 


k) facility status register. 


Aircraft performance 


5.2.35 The air traffic services investigation should establish, record and verify the accuracy of all information 
relevant to actual performance of the occurrence aircraft, in particular the flight planned performance should be 
compared to actual performance achieved. Valuable information may be derived from recorded data, observations, 
photographs, eyewitnesses, or from other air traffic services personnel or aircrew in the vicinity. 


5.2.36 The selection of data to be collected and reviewed will be dependent upon the circumstances of the 
occurrence being investigated. However, it is most desirable that the investigation examine the original rather than 
copies of the recorded data wherever possible. It may be necessary, in certain cases, to have the Operations Group 
examine the data from which flight manual performance is determined in order to establish its relevance to the particular 
circumstances. 


5.2.37 The air traffic services investigation should establish, record and verify the accuracy of all information 
relevant to its activity in relation to the conformance of the flight. This may include determination of expected outcomes 
originating from any air traffic services control instruction, information or advice compared with the actual outcomes. 
Reconstruction of horizontal and vertical profiles of the flight by use of factual data may be a useful tool in determining 
the air traffic service officer's knowledge and expectation of the aircraft performance in the air traffic service system. For 
example, was the clearance instruction within the capability of the aircraft performance envelope, or was the aircraft 
directed towards hazardous weather or terrain, etc. Dependent upon the nature of the occurrence, some or all of the 
following items may be relevant: 


a) knowledge of aircraft performance and limitations; 
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b) reconstruction of relevant flight profiles; 
c) flight plan validity and conformance; 
d) horizontal and vertical navigation; and 


e) aircraft physical operating environment emergency operations. 


Standard operating procedures and practices 

5.2.38 Whilst it is not the function of an air traffic services investigator to become involved in the disciplinary 
aspects of the enforcement of regulations and instructions, it is a necessary part of the investigation to establish whether 
the applicable directives, operating standards, procedures and practices were complied with. All relevant material should 
also be examined to establish whether, in the light of the occurrence, they were proper and adequate for ensuring safety 
of operations, and whether they were presented in a format easily understood. It may be necessary to also consider the 
safety lessons and preventative aspects of recommending a review of the existing directives, operating standards, 
procedures and practices or development of new material. In examining these matters it is important to distinguish 
between what material has mandatory effect and what is advisory. The directives, operating standards, procedures and 
practices may have many different forms. It is important to consider and evaluate all aspects of the investigation such as 
expedition of traffic processing, off-airways dynamic or direct tracking, vectoring and holding manoeuvres which may be 
causal factors. Items that should be checked and verified may comprise a combination of the following: 

a) national legislation; 

b) ICAO Annexes; 

c) ICAO Procedures for Air Navigation Services; 

d) air traffic services manuals and instruction circulars; 

e) workstation/sector handbooks and/or instructions; 

f) copies of any pertinent letters of agreement; 

g) map/chart of area of responsibility; 

h) co-ordination requirements with other units; 

i) aeronautical information publications; 

j) applicable aircraft proximity standards; 

k) NOTAMs; 

1) flight progress preparation, processing and displays; 


m) level change and non-standard flight levels procedures; and 


n) communications, navigation and surveillance procedures. 
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Witness interviews 


5.2.39 The air traffic services investigator should bear in mind obligations to comply with the laws of the State in 
which the air safety event occurred and that in some States it may be the responsibility of the police to carry out witness 
interviews. It may be desirable because of the circumstances of the occurrence to form a witness group for locating 
witnesses and collecting their statements. If such a group is formed it normally concerns itself with interviews with “eye 
witnesses” located in the vicinity of the occurrence: the witnesses’ interviewing appropriate to other groups, e.g. 
structures, operations, is generally performed by an investigator within that group. Collecting evidence from witnesses is 
one of the investigator’s main tasks; information thus obtained can, in fact, furnish a lead to obtaining further evidence or 
complement and/or clarify evidence already presented. The air traffic services investigation must not, however, overlook 
human fallibility, and must exercise great caution when analyzing statements from witnesses that obviously conflict with 
established material evidence or attempts to divert the focus of the investigation from accident prevention and safety 
enhancement. 


5.2.40 States should determine if written statements should be obtained from all personnel who were involved in 
the provision of air traffic services for the aircraft involved in the occurrence. The air traffic services investigation should 
consider the benefits derived from a reconstruction of the occurrence and a complete briefing (walkthrough) of the facts 
surrounding the occurrence, including the involvement of any other air traffic service facility. It is important to replay the 
original recordings to assist in orientation of the circumstances of the occurrence in real time. At this early point in the 
investigation, the investigator needs to assimilate the knowledge that the various air traffic services personnel have of 
the circumstances and events associated with the occurrence so that the investigation can be effectively planned. It 
would then be appropriate for the investigation to establish a timetable and list of the personnel to be interviewed and to 
arrange an appropriate interview facility. 


Flight reconstruction 


5.2.41 ATS surveillance systems and/or synthetic digital data constitute vital information for reconstructing the 
progress of relevant aircraft and presenting horizontal and vertical navigation profiles for analysis. This may also require 
analysis of other aircraft not directly involved in the occurrence. 


5.2.42 Various recording and replay systems have been developed by States. Such systems vary from one which 
consists of time-lapse filming (one frame per sweep) of the spots representing moving aircraft on display screens, to 
digital electronic technology recording defined parameters in binary formats. The data is normally retained for at least a 
month and replayed only in the event of an occurrence. 


5.2.43 The reconstruction of the relevant stage of the flight, i.e. the occurrence phase, necessitates close 
coordination between many areas of the investigation but it may be of equal concern to the Operations Group. The 
intention should be to build up a complete picture of the final events as they occurred in proper sequence and evaluate 
their interrelationship. The period of time to be covered will depend upon the circumstances; in general terms it should 
commence at a stage where the flight departs from normal operational parameters and it can terminate at either the time 
of the occurrence or a subsequent time which is significant to the investigation. Where it is desired to synchronize 
display and audio programmes, the starting point must be clearly defined. This information may also form an essential 
link with information obtained by other investigation groups and will provide the basis of the reconstruction when 
combined with available recordings of all related activities on the ground and on-board the aircraft. 


5.2.44 Dependent upon the nature of the occurrence, some or all of the following items may be relevant: 
a) separation standard; 


b) relative tracks; 
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c) horizontal and vertical proximity; 

d) surveillance services available/provided; 
e) evasive actions; 

f) flight conditions; 

g) collision avoidance systems available; and 


h) aircraft proximity assessment. 


Sequence of flight 
5.2.45 The reconstruction of ATS surveillance system data may bring to light items of importance in the 
Operations investigation in relation to the other areas of the occurrence investigation. It may also happen that the 
particular characteristics of the occurrence necessitate not only the reconstruction of the occurrence flight but other 
previous flights. 
5.2.46 Although the investigation will have to devote particular attention to the phase in which the event occurred, 
it will usually be desirable to evaluate the development of the entire sequence of the flight. Display reconstructions can 
also assist the investigation of occurrences such as near mid-air collisions and provide data for establishing aircraft 
proximity. The air traffic services investigation should be aware of possible software and display anomalies such as: 

a) target swapping; 

b) data block swapping; 

c) swapping of target tracks with other aircraft and/or false targets; 

d) incorrect data blocks; 

e) display clutter; 

f) data blocks becoming detached from assigned targets; and 

g) displaced target symbols. 
5.2.47 Dependent upon the nature of the occurrence, some or all of the following items may be relevant: 

a) displays facilities; 

b) symbols; 

c) data blocks, leader lines and orientation; 

d) control settings; 


e) display operator notes; 


f) aircraft identification procedures; 
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g) sensors inputs; 

h) display mapping; 

i) coverage diagrams; 

j) terrain clearance charts; 

k) SSR code; 

1) system display track number; 
m) system alerts and alarms; and 


n) point of closest approach. 


Flight profile reconstruction 


5.2.48 In occurrences such as aircraft proximity violations, mid-air collisions and flight into terrain, the air traffic 
services investigation should establish, record and verify the actual horizontal and vertical flight profiles of the aircraft 
concerned. Reconstruction will be limited only by information derived from all available recorded data sources obtained 
by air traffic services or on-board recorded systems where available. The reconstruction should be cross checked with 
any witness statements. 


5.2.49 The selection and availability of data will be dependent upon the particular circumstances of the 
occurrence being investigated. However, it is most desirable that the investigation examine the original rather than 
copies of the recorded data wherever possible. It may also be necessary, in certain cases, to have the operations group 
examine and obtain aircraft performance data in order to establish and compare the flight path profile reconstruction with 
manufacturer's data and its relevance to the particular circumstances. 


5.2.50 The air traffic services investigation should establish, record and verify the accuracy of all information 
relevant to the conformance of the flight in the horizontal and vertical planes. The reconstruction may include 
determination of actual and expected outcomes originating from any air traffic services control instruction, information or 
advice directed to the occurrence aircraft. Reconstruction of horizontal and vertical flight profiles which include a 
combined timeline and geographic location reference obtained from verified data may be a very useful tool for the air 
traffic services investigation in developing the progress of the aircraft through the air traffic services system. 


5.2.51 Dependent upon the nature of the occurrence, some or all of the following items may be relevant to the 
reconstruction of the flight profiles and variations between actual and planned flight profiles: 


a) horizontal trajectory and deviations; 

b) vertical trajectory, deviations and altitude busts; 
c) rate of climb/descent; 

d) ground speed(s); 

e) estimated/actual time intervals; and 


f) waypoints and geographic graticule. 
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ATS duties and functions 
5.2.52 The air traffic services investigation should establish, record and verify all documentation relating to local 
orders and/or instructions prescribing the duties and functions of all relevant air traffic services operating positions 
directly or indirectly involved with the occurrence. The investigation should also consider the effectiveness of the above 
documentation and the standardization aspects to ensure that communication of relevant information to the aircraft 
concerned and other relevant air traffic services personnel was accomplished without delay and in accordance with 
prescribed standard operating procedures. 


5.2.53 Dependent upon the nature of the occurrence, some or all of the following items may be relevant to each 
air traffic services officer or workstation connected with the specific occurrence: 


a) duties and functions; 
b) area of responsibility; 
c) air traffic management responsibilities; and 


d) co-ordination responsibilities. 


Work practices and staffing 
5.2.54 It may be desirable because of the circumstances associated with the occurrence for the air traffic services 
investigation to examine the actual work practices and staffing situation in the period surrounding the occurrence. Where 
documentation is available, it should be collected and verified. Such documentation should be supported by statements 


from relevant personnel as appropriate to the circumstances of the occurrence. 


5.2.55 The pertinent work practices and staffing issues relating to the occurrence should be examined with a view 
to determining whether: 


a) applicable regulations and standard operating procedures were satisfactory and were adhered to; 
b) differences existed between workload and human resource; and 
c) effective use was made of all Known and relevant information. 
5.2.56 Dependent upon the nature of the occurrence, some or all of the following items may be relevant: 
a) prescribed work practices; 
b) actual and required staffing requirements; 
c) licensing and staffing qualifications/requirements; 
d) recency and ratings qualifications/requirements; and 


e) initial and continuation training. 
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Workstations 


5.2.57 As well as investigating the operating environment of the aircraft, it is essential that the air traffic services 
investigation extends to the relevant aeromobile and associated workstations. It will be necessary to investigate not only 
the efficiency and effectiveness of the air traffic services detailed event transactions and detailed event reconstruction to 
provide evidence verifying progress of the flight, but also the human-machine interface aspects of the system as a whole. 
In doing so it is important to clearly define the start and end points for the investigation of the actual occurrence. 


5.2.58 The air traffic services investigation should establish the operating configuration and ergonomic aspects of 
the workstation in use in addition to operational information and situational awareness displays. Collection, collation and 
verification of all relevant elements such as flight progress displays, maps and charts, hardware, software systems, 
facility controls and presentation are essential items in reconstruction scenarios. 


5.2.59 It is important to critically examine workstation systems and sub-systems to determine their adequacy in 
relation to the particular occurrence and possible effects on other similar future events. It may also be relevant to 
consider the relevance of adequate illumination, workload and distractions in the vicinity of the workstation. Consistency 
of documentation held by air traffic services personnel and aircrew should be examined, e.g. maps and charts. These 
aspects should include an assessment of issues which could be forwarded to the Human Factors Group. 
5.2.60 Dependent upon the nature of the occurrence, some or all of the following items may be relevant: 

a) display maps and charts; 

b) air situation and flight progress display; 

Cc) operational information display; 

d) workstation ergonomics; 

e) workstation modifications, serviceability, active systems configuration and operational status; 


f) communications systems configuration and operational status; and 


g) headset and microphone facilities. 


Traffic processing sequence — Tactical and strategic 


5.2.61 Investigation of all the facts pertaining to the air traffic services tactical and strategic traffic processing 
sequence should be considered an essential element in the reconstruction of the history of the flight. 


5.2.62 Information obtained, such as unauthorized horizontal and/or vertical excursions and violations may also 
be relevant to specific operations and human factors investigations. Because these aspects are often closely related, 
careful collection, collation and evaluation of the pertinent facts is required to achieve the best possible use of the 
information collected. The tactical processing sequence will normally be recorded in some media and verified by careful 
analysis of data and personnel statements. The strategic processing sequence and planning may be a more difficult task 
and may require more selective in-depth interviewing techniques to ascertain anticipated traffic processing and 
expectations of outcomes. 


5.2.63 Dependent upon the nature of the occurrence, some or all of the following items may be relevant to 
determining tactical (short term/immediate) and strategic (long term/later) processing effects and outcomes: 
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a) terminal airspace approach and departures; 

b) enroute airspace; 

c) holding and diversions; 

d) _ traffic flow, speed control and level assignments; 
e) onand off-airway flight paths; 

f) air traffic information management; and 


g) air traffic sequencing and priorities. 


Traffic disposition 


5.2.64 The air traffic services investigation should try to establish and reconstruct the actual traffic disposition for 
a defined time prior to an occurrence and at the actual time of the occurrence. Recorded flight progress display data will 
normally provide all essential information to permit reconstruction of the horizontal and vertical traffic disposition for 
analysis. It is equally important that the air traffic services investigation not only reconstruct the actual traffic disposition, 
but that air traffic services personnel be given the opportunity to present their views and/or estimation of the situation. 
For example, an aircraft may have unintentionally been assigned a heading or level different to that intended by the air 
traffic service person with jurisdiction for the aircraft. 


5.2.65 Dependent upon the nature of the occurrence, some or all of the following items may be relevant to 
reconstructing the traffic disposition and possible variations of actual and planned flight paths for each active aircraft: 


a) airspace jurisdiction; 


b) ATS routes and waypoints; 


c) range; 
d) azimuth; 
e) level; 

f) track; 


g) holding pattern; 
h) meteorological effects; and 


i) vertical and horizontal separation minima. 


Information flow coordination and aircraft movement messages 


5.2.66 The provision of safe, orderly and expeditious air traffic management is totally dependent upon exchange 
of timely and accurate information flow, coordination and distribution of aircraft movement messages throughout the air 
traffic services system. This process is as important as the information and instructions provided to aircrew and forms an 
essential element of any air traffic services investigation. It requires: 
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a) a thorough understanding of mutual responsibilities; 

b) careful application; 

c) comprehensive training; and 

d) unambiguous communications. 
5.2.67 In order to gather this information, the investigation may have to obtain a number of statements from 
personnel concerned, and make extensive use of air traffic services’ recorded data. The extent to which any of the 
above information is required will depend on the particular nature of the occurrence under investigation. Dependent 
upon the nature of the occurrence, some or all of the following items may be relevant in ascertaining information flow, 
co-ordination and distribution of aircraft movement messages to, from, or between, co-located/remote air traffic services 
personnel and units: 

a) unit responsibilities; 

b)  inter-unit communications; 

c) intra-unit communications; 

d) distribution of aircraft movement and control messages; 

e) frequency change management; 

f) phraseology; 


g) readback/hearback errors and omissions; and 


h) flight progress display data and notations. 


Situational awareness 


5.2.68 Numerous aircraft and operational displays, when combined with effective and efficient communications 
and facilities, provide air traffic services personnel with the cues to devise and deliver essential instructions and 
information to aircraft. In some situations, aircraft maintain predefined flight path trajectories on published airways and, 
in others, the aircraft may be in user-preferred trajectory (4-D). In practice, any one air traffic services unit may have 
jurisdiction of a mixture of aircraft moving in four dimensions. Understanding of the situational awareness forms an 
integral part of the air traffic services investigation. Information obtained, such as real or perceived differences in the air 
traffic services personnel’s awareness of aircraft disposition and range may also be relevant to specific operations and 
human factors investigations. Many of these aspects are often closely related and careful collection, collation and 
analysis of the information is required. 


5.2.69 Dependent upon the nature of the occurrence, some or all of the following items may be relevant: 
a) active and pending traffic disposition; 
b) flight progress display; 


c) communications; 
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d) facility control and presentation settings; 

e) aircraft performance; 

f) actual and expected meteorological situation; 

g) airspace operational configuration, instructions and limitations; and 


h) terrain and other obstructions. 


Separation assurance techniques 


5.2.70 Effective tactical and strategic air traffic management techniques, procedures and practices are essential 
elements for the implementation of separation assurance techniques in the air traffic services system. Separation 
assurance as distinct from achieving separation becomes significant in any air traffic services investigation where 
prescribed aircraft proximity standards have been violated due to human or system failures. There are many situations 
where aircraft proximity standards could be violated even where all aircraft comply with their given instructions or 
information. For example, two aircraft operating at the same correct level may be converging on the same waypoint at 
the same estimated time. However, it is usually left to a matter of timing for air traffic services units to recognize, 
respond and rectify potential aircraft proximity occurrences before a prescribed standard is violated. The air traffic 
services investigation should establish if the required separation assurance was in place and if it could have been 
maintained in the event of failure of any single, or multiple component failure of the air traffic services system, such as 
communications or surveillance facilities. 


5.2.71 Dependent upon the nature of the occurrence, some or all of the following items may be relevant to 
determining continuous effective planning and implementation of separation assurance techniques: 


a) selected procedure for vertical and horizontal separation; 


b) tactical and strategic traffic processing including procedures for accommodation of non-approved 
aircraft into RVSM airspace; 


c) airways and available communications facilities; 


d) conflict warning systems; 


e) timely execution; 


f) monitoring and surveillance of traffic; and 


g) re-evaluation of outcomes. 


Workload and distractions 


5.2.72 Workload refers to the tasks performed by air traffic services personnel relative to a given set of conditions, 
environment and air traffic complexity. It is more subjective than objective in the evaluation process and normally the 
individual involved is best placed to assess the workload and any other distractions which may have contributed to an air 
safety occurrence. For example, while all air traffic is being processed in a safe, orderly and expeditious manner and 
there are no abnormal or emergency situations present, an individual may assess the workload as light. However, if the 
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traffic level were reduced by half and the complexity or abnormal operations increased, the same individual may then 
assess the workload as moderate or high. On some rare occasions the workload may exceed the capacity of the system 
and the individual air traffic services officer to cope, resulting in a serious air safety occurrence. 

5.2.73 Distractions in the immediate vicinity of the workstation may also contribute to increased workload 
unknown to the individual. For example, high levels of noise may require the individual at the workstation to have to 
request repeats of communications exchanges which subsequently reduces information processing time. Equally, poor 
communications facilities may make it difficult to obtain a required report or response. Objective evaluation of the actual 
workload and any distractions relevant to the occurrence forms an integral part of the air traffic services investigation 
and may also be relevant to operations and human factors investigations. 


5.2.74 Dependent upon the nature of the occurrence, some or all of the following items may be relevant to 
determination of workload: 


a) uninterrupted communications; 

b) timely coordination; 

c) airspace dimensions and configuration; 
d) mix of aircraft types; 

e) aircraft performance; 

f) operational and non-operational activity in the workstation vicinity; 
g) task complexity; 

h) fatigue; 

i) facilities status; 

j) information queuing and processing time; 
k) recognition of task saturation; 

1) task reduction techniques; and 


m) system alarms and message queue processing. 


Conflict detection and safety net 


5.2.75 The air traffic services system has many built-in defences which form a safety net to protect it from human 
or system error. These defences include requirements to read back specific instructions, waypoint reporting and posting, 
one-way ATS route structures, standard levels, standard instrument departure and arrivals procedures and on-board 
and terrestrial conflict alerting systems. These defences are intended to ensure that the potential for traffic conflicts 
resulting from errors or omissions on the part of aircrew or air traffic services personnel are minimized. However, in 
many cases the majority of conflict detection defences and safety net integrity depend upon the tactical and strategic 
situational awareness of individuals, i.e. awareness of the “big picture”. Aircraft proximity violations are the result of 
failures to detect conflicts or failure of safety net integrity. In the majority of cases the various layers of the safety net 
defences act to protect the air traffic services system and participants. For example, should an incorrect clearance be 
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directed to an aircraft, the aircrew may recognize and report that the instructions are not applicable or the air traffic 
services personnel may detect the error or omission when reviewing or updating the flight progress display. Where 
system defences have been breached resulting in an aircraft proximity violation, or collision, there is normally a 
sequence of contributing causal factors. The air traffic services investigation is tasked with establishing, recording and 
verifying the causal factors and formulating appropriate safety actions. Information relevant to determining how the 
conflict was detected and features of the safety net require a checklist. Dependent upon the nature of the occurrence, 
some or all of the following items may be relevant: 


a) situational awareness; 

b) tactical and strategic plan; 
c) flight progress display; 

d) communications; 

e) information flow; and 


f) conflict alert and avoidance systems. 


Investigation of airspace management practices 


5.2.76 In accidents where the aircraft was involved in, for example, a mid-air collision, a collision with the ground, 
or an accident during initial climb or approach, investigators should evaluate how the airspace in the area is managed. In 
the case of flight under instrument conditions, or in airspace reserved for aircraft flying under instrument flight rules, the 
conformance to national airspace design and clearance is essential to the understanding of the circumstances 
surrounding the accident. Many issues under this area involve air traffic services. However, investigators should be 
cognizant of the following issues from both an ATS and an aircraft operator perspective. 


5.2.77 On almost every occasion, it will be necessary for the air traffic services investigation to establish and 
verify all documentation, local orders and/or instructions relevant to the standard operating practices for airspace 
management. The investigation should consider the effectiveness of the above documentation and the standardization 
aspects to ensure that the applicable airspace management practices relevant to the airspace environment of the aircraft 
concerned and any other relevant air traffic services authority were applicable and applied in a correct and timely 
manner. In particular the investigation should address the status of the airspace and any special conditions, rules or 
procedures in place around the time of the occurrence, e.g. controlled, non-controlled, application of RVSM and 
deactivated airspace. 


5.2.78 Dependent upon the nature of the occurrence, some or all of the following items may be relevant to 
airspace management issues: 


a) establishment of airspace and legal status; 
b) administrating and controlling authority; 

c) controlled and non-controlled airspace limits; 
d) provision of air traffic services; 


e) special use, prohibited, restricted airspace and danger areas; 
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f) coordination requirements; 

g) airways clearances, block clearances and airspace reservations; 
h) _ traffic priorities; 

i) military activities; 

j) national contingency plans; and 


k) limits of RVSM airspace and transition areas. 


En route 


5.2.79 During cruise, the aircraft is usually at an assigned altitude, either given by ATS, or determined by 
adherence to specific rules. Aircraft operating under visual flight rules, for example, are to cruise at specific altitude (odd 
or even thousand plus 500 ft if flying below FL290) depending on course. Under instrument flight rules, ATS assigns a 
specific altitude which conforms to State established clearance from obstacles and other aircraft. Transitioning from one 
State or FIR or portion of airspace to another may result in a change in enroute airspace design changes and these 
should be evaluated and compared to crew actions. 


Terminal procedures 


5.2.80 Terminal procedures are based on two factors: performance capability of the aircraft and equipment, both 
on the ground and in the aircraft. When an aircrew is assigned a procedure, the controller assumes the aircraft has both 
the ability to fly the procedure and the proper equipment for the procedure assigned. This is often communicated in the 
flight plan, but it remains the aircrew’s responsibility to accept the procedure cognizant of these factors. For example, it 
may be physically possible for a crew to fly a non-directional beacon (NDB) approach requiring two airborne direction 
finder (ADF) receivers with only one receiver installed. Without the designated equipment, however, the ability of the 
crew to ensure terrain clearance may be circumvented. This may be especially true as global positioning satellite (GPS) 
systems become more common. It is relatively simple for a pilot using GPS to fly a ground-track depicted on an 
approach for which the aircraft does not have the proper equipment, but terrain clearance and proximity to other traffic 
cannot be depicted. GPS approaches have to be certified by the State, like any other procedure. 


Climb 


5.2.81 During climb to altitude, specific obstacle clearance and gradient of climb may be required. The availability 
of published data concerning the procedures is essential for crew understanding of the restrictions that may reduce 
these clearances. Design requirements should be evaluated based on the routing, standard departure or vectors 
provided by controllers. 


Approach and Landing 


5.2.82 Like climb, arrival procedures have specific design criteria. A designated runway may have several 
approaches available. An arrival procedure designed to establish a flow of traffic may be assigned to ensure terrain 
clearance and traffic separation. Deviation in routing, airspeed, or altitude may subject an aircraft to hazards not 
depicted in the published procedure. 


Ill-5-30 Manual of Aircraft Accident and Incident Investigation 





5.2.83 If an aircraft was attempting a published approach when the accident occurred, investigators should 
attempt to examine the actual approach plate diagram being used by the crew, as there are several sources of published 
approaches available. Published approaches are usually designed first by the State agency responsible for this action. 
Commercially available approach diagrams utilize these as models, but no further flight testing is normally accomplished. 
The commercial vendor may add data to the approach plate, or change how it is depicted. 


Non-standard procedures 


4.2.84 a) Noise abatement. Many airports have been encroached upon by the population to the extent that 
airport management has been forced to require out-of-the-ordinary procedures in order to climb out or 
arrive with the minimum of noise to the population below. This procedure normally calls for the crew, 
once safely airborne, to abruptly climb in order to be above a pre-established altitude when departing 
the airport boundaries. Similarly, a steeper than normal approach may be called for. Still others require 
a turn, even at low altitude, to fly over less noise-sensitive areas. While these procedures make sense 
in the normal operations world, an aircraft with an emergency may be placed dangerously close to its 
safety margins. When the procedure becomes “standard” to a crew operating from the locale 
repeatedly, the crew may continue to fly the procedure while dealing with a problem without 
considering the effect of the emergency on the procedure. This is a function of awareness and 
attention which is discussed under Human Factors in Chapter 16. For example, the crew of an aircraft 
sustaining an engine failure after takeoff may deal with the engine failure while still pulling the aircraft 
nose-up to follow a normal noise abatement takeoff procedure. 


b) Course/clearance changes. |n the course of flying either a published approach or departure, it is not 
uncommon for an ATS controller to assign an aircraft a vector off the normal routing. Communications 
should be evaluated if the accident occurred during this period. Accidents have been documented in 
which the aircraft collided with terrain or obstacles due to the pilot relying on the ATS controller to 
maintain both terrain, obstacle and traffic separation. 


5.3. AERODROME FACILITIES 


General 


5.3.1 When an accident involves departure from, arrival at or when it occurs within the confines of an aerodrome, 
the investigator needs to have the facilities evaluated for contribution to the accident sequence. Criteria established by 
ICAO Annex 14 and State legislation are intended to make these facilities as safe as possible for operations of aircraft. 
Deviations from established standards need to be evaluated in light of the accident. However, investigators should also 
continue to evaluate the standards themselves in case they present some unacceptable risk to the aircraft or occupants. 


5.3.2 Due to the continuing evolution of aerodrome standards, it is not always feasible for all airports to meet all 
criteria. In some cases, deviations from standards are necessary for continued operation. Investigators should make 
themselves aware of any deviations from standards, and the status of the airport in light of current standards. When 
permanent hazards have not been corrected, or when decisions have been made to not comply with a specific standard, 
the investigator must evaluate these conditions for adequacy. 


5.3.3 As circumstances dictate, the investigator may have to examine and verify the condition and status of 
many aerodrome facilities used by or available to the aircraft involved in the accident (see Annex 14). 


Part Ill. Investigation 
Chapter 5. Aircraft Operating Environment Ill-5-31 





Runway in use 


Runways 


5.3.4 When the takeoff or landing is directly involved in the accident sequence, the investigator should evaluate 
the following and their potential contribution to the accident sequence: 


a) 


qd) 


dimensions (length and width) of runways, stopways, clearways, runway strips, runway end safety 
areas (RESA), deceleration areas and shoulders; 


location of threshold at the time of the accident; 

1) this should address the intentional use of less than the full runway available; and 

2) is the position visible from the tower (blindspots)? 

runway markings including centre line, side stripe, and touchdown zone markings. Also examine 
runway designation, threshold, fixed distance, and taxi-holding position markings. Notice should also 
be taken of special markings such as land-hold short markings, acute angle taxiway lead-in lines, 
runway displacement and/or relocation markings and any specialized markings for use during low- 


visibility operations. e.g. Surface Movement Guidance and Control System (SMGCS); 


runway signs including hold-position signs, ILS critical area signs, distance remaining signs and 
destination signs, as appropriate; 


Lighting; 
1) approach (type, dimensions, colour, intensity); 
2) VASIs, PAPIs and PLASI (check alignment); 


3) runway edge, threshold, and end (colour, intensity and number and locations of inoperative 
fixtures); 


4) runway centre line and acute-angle taxi centre line (colour, intensity and number and locations of 
inoperative fixtures); 


5) runway touchdown zone, distance remaining marker illumination and locations, land-hold short 
lighting; and 


6) Runway environment and background lighting contrast including lighting distractions such as laser 
lights or special events; 


runway and/or runway end elevation(s) slopes, and gradients); 

type(s) and descriptions of surface(s), concrete, asphalt, porous friction course, gravel, etc. Also 
describe measurements, depths, and conditions of texture treatments for diminishing the effects of 
hydroplaning, such as runway grooves and any friction treatments; 


runway surface condition — describe levels, textures and dimensions of contaminants; 


1) surface type; 
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2) current condition (dry, wet, ice, snow, slush, etc.); 


3) excessive rubber buildup; 
4) presence of debris (potential for foreign object damage (FOD)); and 
5) evaluate the frequency and adequacy of runway sweeping schedules; 


i) texture and coefficient of friction measurement, conduct pavement texture measurements and 
coefficient of friction evaluations in accordance with Airport Services Manual, Part 2, as appropriate, 
utilizing approved continuous friction measuring equipment (CFME); 


j) | runway bearing strength; 


k) aircraft arresting system (presence of military equipment on civil aerodromes and the effect of contact 
with it); 


1) obstructions, construction hazards and frangibility. Describe protruding objects and/or ruts, ditches, 
holes or depressions within or near safety areas and ascertain the degree of frangibility of near- 
runway equipment or markings. Careful examination of frangible object support bases for erosion 
which may render the base more of a hazard than the equipment mounted upon it; 


m) work in progress (NOTAM or ATIS applicable); and 


n) wildlife hazards — history and description of aerodrome programmes for reducing incursions with 
aircraft by wildlife. Review relevant NOTAMs or ATIS, if any. 


Alternative runways 


5.3.5 Investigators should evaluate all runways available in light of the aircraft condition and the nature of the 
emergency, if present. The assignment of the runway by a controller or the selection of a runway by the crew is 
sometimes dictated by need, in which case it may be appropriate. In other cases, the assignment or selection was made 
for convenience rather than with consideration of the actual requirements. Where pertinent, the factors listed above 
should be used to evaluate alternative runways. 


Taxiways 


5.3.6 The route of taxi to/from an active runway should be evaluated. Similar to runways, the assignment or 
selection of the route of taxi should be compatible with the aircraft and the circumstances. Dependent upon the nature of 
the occurrence, some or all of the following items may be relevant: 


a) bearing strength; 

b) dimensional adequacy, shoulders; 
c) markings; 

d) _ lighting; 


1) taxiway (centre line, edge, surface movement guidance and control and aerodrome sign 
illumination, etc.); 
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2) aerodrome lighting vaults and control tower lighting panels as appropriate; 
3) aerodrome beacon; and 


4) obstruction; 


e) obstructions; 
f) | current condition; 
1) dry, wet, ice, snow, slush, etc.; 
2) presence of debris (potential for foreign object damage (FOD)); and 
3) evaluate the frequency and adequacy of runway sweeping schedules; 
g) layout; 
1) logical sequencing; 
2) ground radar; and 
3) blind spots; 
h) type of surface and surface qualities; and 
i) work-in-progress (NOTAM or ATIS applicable). 
Apron or ramp 
5.3.7 The condition of the aircraft parking area with regard for the requirements of the aircraft involved should be 


evaluated. The following items may be relevant: 


a) 
b) 


c) 


qd) 


bearing strength; 

condition; 

markings; 

1) signage; 

2) “red” zones; 

3) FOD areas; 

4) paintovers; and 

5) nosewheel stop markings; 


lighting (edge, floodlights, etc. ); 


Ill-5-34 Manual of Aircraft Accident and Incident Investigation 





e) obstacles; 

f) jetways; 

g) proximity to active runways; 
h) vehicle operations; 

i) high power areas; and 


j) _ blind spots. 


Other aerodrome issues 


Navigation aids (NAVAIDS) 


5.3.8 The presence and location of navigation aids is frequently a factor in the successful (or unsuccessful) 
departure or approach and landing. The compatibility of aircraft equipment with the NAVAIDS available sometimes 
determines the selection of available runway or approach. 


Air traffic control 


5.3.9 While 5.2 deals specifically with the investigation of air traffic services, investigators should also investigate 
the practices and procedures for ground movement. In some cases where air traffic services are limited or non-existent, 
ground movement is not monitored by a controlling agency. In this case, pilots are responsible for movement and 
clearance to and from active runways and for their own takeoff/landing clearance. 


Communications 


5.3.10 Communications between aircraft or between aircraft and air traffic services usually necessitates radio 
transmissions. Several factors involving communications have been linked to accident factors and, therefore, should be 
considered by investigators. 


Common frequency 


5.3.11 Complex operations sometimes involve communications between multiple controllers or agencies. Use of 
multiple frequencies for different parts of the aerodrome as well as for different controllers complicates communications. 
In some cases, air traffic communicated with a single controller on two separate frequency bands (VHF and UHF, for 
example). This is sometimes the case with the presence of military traffic on civil aerodromes. In this case, each aircraft 
overheard only one-half of the communications between an air traffic controller and another aircraft. This may lead to 
confusion. 


Single frequency approach 


5.3.12 When handling an emergency aircraft, it has become increasingly useful to assign a single frequency to 
the aircraft. Air traffic controllers utilize this emergency frequency as control of the aircraft is passed from one controller 


Part Ill. Investigation 
Chapter 5. Aircraft Operating Environment Il-5-35 





to another. This has demonstrated a simplification of procedure from the crew perspective. They are handling an 
emergency condition and are less capable of making multiple frequency changes than the respective controllers enroute 
to landing. 

Language 

5.3.13 ICAO standards require pilots and air traffic controllers to have a specified proficiency in English. However, 
it is very common for communications in non-English speaking States to be in the native language. This has been found 
to be a contributing factor in several aircraft accidents in which communications were not understood by the various 
aircraft and controllers involved. 

Emergency and rescue services 


Civil aerodrome requirements 


5.3.14 Annex 14, Chapter 9 identifies the basic requirements for Crash, Fire and Rescue (CFR) at civil 
aerodromes. Some of these standards include: 


a) _ fire-fighting service; 
1) equipment; 
2) personnel; and 
3) training; 
b) rescue service; 
1) equipment; 
2) personnel; and 
3) training; and 
c) water rescue capability, if appropriate to the aerodrome location. 
5.3.15 Some of the recommended practices that are key to aircraft accident mitigation include: 
a) category for CFR based on largest aircraft; 
b) CFRresponse within two minutes of alarm to end of farthest runway; 
c) emergency access roads maintained; and 
d) discrete CFR communication system. This system should involve all responding agencies including 
the air traffic control tower. However, it has been demonstrated that the ability of the CFR responders 


to directly communicate with the aircraft is valuable and should be considered if survival is a factor in 
the investigation. 
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Mutual aid resources 
5.3.16 Aerodrome CFR resources have been expanded by the inclusion of municipal and regional fire fighting and 
rescue services. When these services are required by the nature of the accident and are available, it has been 
demonstrated that post-accident response is improved. The following conditions should be investigated to ensure 
mutual-aid CFR contributed to the overall effort: 
a) agency alert and notification; 
b) assembly points and routing; 
c) compatibility of equipment with aircraft accident conditions; 
1) fire fighting; and 
2) communications; 


d) training of mutual-aid CFR personnel; and 


e) inclusion of mutual-aid in command and control assignments. 


Documentation 


5.3.17 Investigators should retrieve and examine the aerodrome documentation with regard to the above. 
Included in this documentation should be: 


a) AIP; 

b) NOTAMSs and current ATIS; 

c) Aerodrome Obstruction Chart (ICAO Type A); 

d) adequacy of dissemination of pertinent information; and 


e) aerodrome operator records (operations logs, NOTAMs, aerodrome inspection records, planning 
documents and minutes, etc.). 


5.4 ICING 


General 


5.4.1 Potentially hazardous icing conditions occur not only in flight but also on the ground prior to flight. Ice 
accumulations on the order of a few thousandths of an inch on critical aircraft surfaces have been shown to significantly 
reduce aircraft lift. It is essential that an aircraft be aerodynamically clean prior to takeoff. In recent years, a number of 
aircraft accidents have been attributed to various aspects of aircraft icing. Large turbojet transport airplanes have not 
experienced any significant safety problems during in-flight icing conditions; they have experienced a number of serious 
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accidents during takeoff in ground icing conditions, such as snow and freezing drizzle. On the other hand, small general 
aviation and commuter airplanes have experienced serious accidents resulting from ice accumulation during in-flight 
operations as well as during takeoff in ground icing conditions. 


5.4.2 As early as 1950, some States had established civil aviation regulations prohibiting take-off for aeroplanes 
with frost, snow, or ice adhering to wings, propellers or control surfaces of the aeroplane. The effects of such icing are 
wide- ranging, unpredictable and dependent upon individual aeroplane design. The magnitude of these effects is 
dependent upon many variables, but the effects can be both significant and dangerous. 


5.4.3 Wind tunnel and flight tests indicate that ice, frost or snow formations on the leading edge and upper 
surface of a wing, having a thickness and surface roughness similar to medium or coarse sandpaper, can reduce wing 
lift by as much as 30 per cent and increase drag by up to 40 per cent. These changes in lift and drag will significantly 
increase stall speed, reduce controllability and alter aeroplane flight characteristics. Thicker or rough ice accumulation in 
the form of frost, snow, or ice deposits can have increasing effects on lift, drag, stall speed, stability and control, but the 
primary influence is surface roughness relative to critical portions of an aerodynamic surface. Ice on critical surfaces and 
on the airframe may also break away during take-off and be ingested into engines, possibly damaging fan and 
compressor blades. Ice forming on pitot tubes and static ports or on angle of attack vanes may give false attitude, 
airspeed, angle of attack and engine power information for air data systems. It is therefore imperative that take-off not be 
attempted unless it has been ascertained that all critical surfaces of the aeroplane, as well as all instrument probes, are 
free of adhering snow, frost or other ice formations. This vital requirement is known as the “Clean Aircraft Concept”. 


5.4.4 Most aeroplanes used in commercial air transport operations, as well as some other aeroplane types, are 
certificated for flight in icing conditions. Aeroplanes so certificated were designed to have the capability to penetrate 
supercooled cloud icing conditions and have demonstrated this in flight. This capability is provided either by ice 
protection equipment installed on critical surfaces, such as the leading edge, or by demonstration that the ice formed, 
under supercooled cloud icing conditions, on certain unprotected components will not significantly affect aeroplane 
performance, stability and control. Ice, frost and snow formed on these surfaces on the ground can have a totally 
different effect on aeroplane flight characteristics than ice formed in flight. Exposure on the ground to weather conditions 
that are conducive to ice formation can cause accumulation of frost, snow or ice on areas of the aeroplane where the ice 
protection provided is designed for in-flight use only. In addition, aeroplanes are considered airworthy and are 
certificated only after extensive analyses and testing have been accomplished. With the exception of analyses and 
testing to ascertain the flight characteristics of an aeroplane during flight in icing conditions, all analyses and certification 
testing are conducted with a clean aeroplane flying in a clean environment. If ice formations other than those considered 
in the certification process are present, the airworthiness of the aeroplane may be invalid and no attempt should be 
made to fly the aeroplane until it has been restored to the clean configuration. 


5.4.5 Common practice developed by the aviation industry over many years of operational experience is to de- 
ice/anti-ice an aeroplane prior to take-off. Various techniques for ground de-icing/anti-icing aeroplanes were also 
developed. The most common of these techniques is the use of FPD fluids to aid the ground de-icing/anti-icing process 
and to provide a protective anti-icing film to delay the formation of frost, snow or ice on aircraft surfaces. 


5.4.6 When conditions existed at the time of the accident that indicate a ground de-icing/anti-icing procedure 
should have taken place, investigators should evaluate the adequacy of these procedures and the actual de-icing that 
took place. 


Ground icing 


5.4.7 Research has concluded that fine particles of frost no bigger than a grain of salt and distributed as sparsely 
as one grain per square centimetre can destroy enough lift to prevent the aircraft from taking off. 
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5.4.8 Frost can accumulate on the aircraft surfaces when the surface is below the freezing temperature and 
there is enough moisture in the air to cause the water vapour to sublimate directly out of the air, forming small crystals of 
ice. Ice can form even when the Outside Air Temperature (OAT) is well above 0°C (32°F). An aircraft equipped with wing 
fuel tanks may have fuel that is at a sufficiently low temperature such that it lowers the wing skin temperature to below 
the freezing point. This phenomenon is known as cold-soaking. This situation can also occur when an aircraft has been 
cruising at high altitude for a period of time followed by a quick descent to a landing in a humid environment. Liquid 
water coming in contact with a wing, which is at a below-freezing temperature, will then freeze to the wing surfaces. 


5.4.9 Cold-soaking can also be caused by fueling an aircraft with cold fuel. If there is rain or high humidity, ice 
can form on the cold-soaked wing and accumulate over time. This ice can be invisible to the eye and is often referred to 
as clear ice. Sheets of clear ice dislodged from the wing or fuselage during takeoff or climb can be ingested by aft 
fuselage-mounted engines, thereby causing a flameout or damage. Sheets of dislodged clear ice can also cause impact 
damage to critical surfaces such as the horizontal stabilizer. 


5.4.10 Frost may form selectively on the airplane, accumulating on some surfaces while ignoring others. Most 
pilots know that if an airplane is left on the ramp during a subfreezing night, when there is sufficient moisture in the air, 
frost will appear in the early morning on the upper surfaces of the airplane. The upper surfaces radiate heat into the 
black night sky while the lower surfaces have radiant heat re-radiated back to the airplane from the tarmac. 


Precipitation which freezes to the upper surfaces of the airplane 


5.4.11 Freezing rain is supercooled water which freezes as soon as it makes contact with a surface which is at or 
below water's freezing temperature. Although it provides a relatively smooth coating on the surface, variations in the 
surface can seriously degrade the aerodynamic performance of airfoils, decreasing its lift/thrust-producing capabilities 
while increasing drag. Freezing rain is a hazard both on the ground and in the air. While in the air it strikes first on 
leading edges, and normally freezes while it flows back with the airstream. On the ground, the flow is downward. 


5.4.12 In addition to modifying airfoil aerodynamics characteristics, freezing rain can increase aircraft weight, jam 
flight controls and hamper the pilot’s visibility. Although dry snow should blow off an aircraft as soon as it gains sufficient 
airspeed, snow which has melted and then refrozen is a much more serious issue. Its irregular shape can seriously 
disrupt the airflow over airfoils, decreasing lift and increasing drag. The temperature of fuel in an aircraft’s wings can also 
be a factor in the formation of ground ice. If the fuel temperature is below freezing the upper and lower wing skins can be 
cooled to sub-freezing temperatures even though the ambient air temperature is above freezing. If liquid water comes in 
contact with this sub-freezing structure, a flat thin slab of ice can form. 


Consequences of frost on airplane airfoils 


5.4.13 Although the effects of frost accumulation on the lift-producing surfaces are not as significant as the effects 
of the formation of ice, even a small amount of frost can have a pronounced affect on their ability to produce lift and can 
also create drag. The rough surface of frost can greatly affect the nature of the boundary layer, slowing it and increasing 
its thickness. Airflow separation will occur at lower than normal angles of attack and coefficients of lift will be reduced at 
high angles of attack. The formation of a hard layer of thick frost on the leading edges and upper surfaces of a wing 
have been reported to reduce maximum coefficient of lift by as much as 50 per cent. 


5.4.14 Stall induced by frost will also occur at lower than normal angles of attack. Thus not only will stall speeds 
increase, the accuracy of stall warning devices, which depend on either airspeed or angle of attack, will be degraded. 


5.4.15 It is possible for an accumulation of frost to cause the wings to stall when a pilot attempts to take off at 
normal takeoff speed. Even worse, it can cause the aircraft to roll rapidly and impact the ground at an attitude which 
decreases the chances of crew or passenger survival. 
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Effects of freezing rain or snow on airplane airfoils 

5.4.16 Freezing rain or frozen snow on the upper surface of a wing can cause an even greater effect (than frost) 
on the lift and drag producing abilities of a wing. In addition, the ice can add a significant amount of weight to the aircraft, 
weight that was not accounted for when computing the takeoff roll, takeoff speed, and initial climb speed. Ice can also 


freeze in the gaps and recesses of the primary and/or secondary flight controls, restricting their movement. Furthermore, 
ice can freeze over unheated pitot static ports, denying information to the aircrew and systems which need them. 


The clean aircraft concept 
5.4.17 During conditions conducive to aeroplane icing during ground operations, take-off shall not be attempted 
when ice, snow, slush or frost is present or adhering to the wings, propellers, control surfaces, engine inlets or other 


critical surfaces 


5.4.18 A large number of variables can influence the formation of ice and frost and the accumulation of snow and 
slush causing surface roughness on an aeroplane. These variables include: 


a) ambient temperature; 

b) aeroplane skin temperature; 

Cc) precipitation rate and moisture content; 

d) de-icing/anti-icing fluid temperature; 

e) the fluid/water ratio of the de-icing/anti-icing fluid; 
f) relative humidity; and 

g) wind velocity and direction. 


5.4.19 They can also affect the de-icing capabilities of de-icing fluids and the anti-icing capabilities of anti-icing 
fluids. As a result, a well-defined time for the protection provided by an anti-icing fluid cannot be established. 


5.4.20 Numerous techniques for complying with the Clean Aircraft Concept have been developed. Proper and 
adequate de- icing, followed by an application of appropriate anti-icing fluid, provides the best protection against 
contamination. A visual or physical check of critical aeroplane surfaces to confirm that the treatment has been effective 
and that the aeroplane is in compliance with the Clean Aircraft Concept must be carried out. 


De-icing and anti-icing methods 


5.4.21 A primitive method of ground removal of snow and ice is to sweep off what is loose and then scrape off 
what is frozen to the surface. Another method of preventing the accumulation of frost, freezing rain or snow on an 
aircraft is to keep the aircraft protected from the elements until just prior to its use, e.g. storing the aircraft inside a 
hangar. However if the hangar is unheated or if the aircraft remains outside long enough in subfreezing temperatures, 
frost can form on airfoil surfaces and melted snow can refreeze both on airfoils and within the gaps in controls. 


5.4.22 The most common method of removing ice or snow from large commercial aircraft is the use of a de-icing 
and/or an anti-icing fluid. De-icing fluid is used to remove accumulated snow and ice from the surface of an aircraft. 
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Anti-icing fluid, however, is used to prevent or delay the accumulation of snow or ice on an already clean aircraft. Both 
use a glycol-based Freezing Point Depressant (FPD) in solution to produce a fluid with a freezing temperature below the 
ambient temperature and the aircraft surface temperature. 


5.4.23 The addition of glycol decreases the freezing point of a water solution when in either the liquid or crystal 
phase. As ice melts into the FPD solution, its strength is weakened and the freezing point of the FPD solution will slowly 
rise toward water’s normal freezing temperature. 


5.4.24 It should be noted that the relatively high speed, low static pressure airflow over the wing at the high angle 
of attack associated with takeoff and initial climb is accompanied by a significant decrease in ambient temperature. This 
may cause freezing of water on the wings’ upper surface, water which was just above freezing and was not blown off the 
wing during the takeoff roll. 


5.4.25 Climbing to altitude as well as absorption of additional freezing precipitation also have the potential to 
reduce the temperature of the FDP solution to below freezing. Ground de-icing is not intended to provide any protection 
from ice accumulation once the aircraft is in flight. 


5.4.26 De-icing/anti-icing is generally carried out by using heated fluids dispensed from spray nozzles mounted on 
specially designed de-icing/anti-icing trucks. Other methods include de-icing/anti-icing gantry spraying systems, small 
portable spraying equipment, mechanical means (brushes, ropes, etc.), infra-red radiation, and forced air. 


5.4.27 De-icing/anti-icing fluids are applied close to the skin of the aeroplane to minimize heat loss. Unique 
procedures to accommodate aeroplane design differences may be required. 
De-icing and anti-icing checks 
5.4.28 The pilot-in-command is responsible for ensuring that the aeroplane complies with the Clean Aircraft 
Concept prior to take-off. Certain checks are required before an aeroplane can be safely dispatched. These checks can 
be grouped under three main headings: 

a) checks prior to the application of de-icing/anti-icing fluids; 


b) checks after the application of de-icing/anti-icing fluids; and 


c) special checks i.e. following a delayed departure or weather change. 


De-icing and anti-icing fluids 


5.4.29 The basic function of de-icing/anti-icing fluids is to lower the freezing point of freezing precipitation as it 
collects on the aeroplane and thus delay the accumulation of ice, snow, slush or frost on critical surfaces. De-icing/anti- 
icing fluids are classed as Type I, Il, Ill and IV. Type | fluids have a relatively low viscosity which changes mainly as a 
function of temperature. Type Il, Ill and IV fluids, however, contain a thickener system and have, therefore, a higher 
viscosity which changes as a function of shear force, fluid/water ratio and fluid temperature. Type Il, IIl and IV fluids have 
better anti-icing properties than Type | fluids. 


5.4.30 All de-icing/anti-icing fluids must meet the use criteria established by the operator, fluid manufacturer and 
aeroplane manufacturer and must also be manufactured in accordance with ISO specifications. 
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Type I fluids 
5.4.31 Type | fluids are available in concentrated or diluted (ready-to-use) forms. Concentrated Type | fluids 


contain a high percentage of glycol (i.e. ethylene glycol, diethylene glycol, or propylene glycol or a mixture of these 
glycols). The remainder consists of water, corrosion inhibitors, wetting agents, anti-foaming agents and sometimes dye. 


5.4.32 Type | fluids must be heated to provide an effective de-icing capability. Concentrated Type | fluids must be 
diluted with water to achieve a freezing point that is in accordance with the appropriate application procedure. Due to 
aerodynamic performance and/or freezing-point considerations, Type | fluids as applied are often further diluted for 
application. 


Type Il, Ill and IV fluids 


5.4.33 Type Il and IV fluids are available in diluted and undiluted forms. Undiluted Type II and IV fluids contain a 
significant amount of ethylene glycol, diethylene glycol or propylene glycol. The remainder of the mixture is water, a 
thickener, corrosion inhibitors, wetting agents and sometimes dye. The high viscosity of the fluid, combined with the 
wetting agents, results in a thick coating when sprayed on the aeroplane. To provide maximum anti-icing protection, 
Type Il and IV fluids should be used in an undiluted condition. Type II and IV fluids, however, are also used in a diluted 
condition for de-icing/anti-icing applications at the higher ambient temperatures and low precipitations. For de-icing 
purposes, the fluid must be heated. 


5.4.34 Type Ill fluid can be a diluted Type II or IV fluid that meets the performance aerodynamic test for turbo 
propeller-driven aeroplanes. 


5.4.35 Type Il, Ill and IV fluids have high viscosity, resulting in a much thicker coating of fluid on the wings than 
Type |. The airflow during the take-off roll exposes these fluids to a shear force that causes a loss of viscosity, thereby 
allowing the fluid to flow off the critical portion of the wings prior to rotation. 


5.4.36 Falling precipitation will steadily dilute all types of anti-icing fluids until either the fluid coating freezes or 
frozen deposits start to accumulate. By increasing the viscosity of the fluid (as in Type II or IV), a higher film thickness 
and, hence, a greater volume of fluid can be applied. The greater volume of fluid can absorb more freezing precipitation 
before its freezing point is reached and therefore its holdover time is increased. This protective advantage becomes 
important during freezing precipitation conditions when longer taxi times are expected. In general, Type IV fluids provide 
longer protection than Type II or III fluids. 


5.4.37 Under no circumstances shall an aeroplane that has previously been anti-iced receive a further coating of 
anti-icing fluid directly on top of the contaminated film. When it becomes necessary to apply another coating of anti-icing 
fluid, the aeroplane surfaces must first be de-iced before the final coating of anti-icing fluid is applied. 


Handling of de-icing and anti-icing fluids 


5.4.38 All fluids must be handled in accordance with fluid manufacturers’ recommendations, health and 
environmental regulations, and operator requirements. 


5.4.39 The protective properties of Type Il, Ill and IV fluids will be degraded when the fluid is subjected to 
contamination, improper transportation or storage, excessive heating or when exposed to excessive shear forces during 
fluid transfer or use. 


5.4.40 Quality control methods for handling de-icing/anti-icing fluids, as specified in the approved operator 
programme, must be strictly followed at all times. 
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Holdover times 

5.4.41 Holdover time (HOT) is the estimated time the anti-icing fluid will prevent the formation of ice and frost and 
the accumulation of snow on the protected (treated) surfaces of an aeroplane. These holdover times are generated by 
testing fluids under a variety of temperature and precipitation conditions simulating the range of weather experienced in 


winter. 


5.4.42 Numerous factors that can affect the de-icing/anti-icing capabilities and holdover times of de-icing/anti-icing 
fluids have been identified. These factors include, but are not limited to: 


a) type and rate of precipitation; 

b) ambient temperature; 

c) relative humidity; 

d) wind direction and velocity; 

e) aeroplane surface (skin) temperature; and 

f) de-icing/anti-icing fluid (type, fluid/water ratio, temperature). 
As a result, a well-defined time for the protection provided by an anti-icing fluid cannot be established. 
5.4.43 The operator should publish the holdover times in the form of a table or diagram to account for the various 
types of ground icing conditions that may be encountered and the different types and concentrations of fluids used. A 
range of holdover times for a particular condition is recommended to account, to some degree, for the variation in the 
existing local meteorological conditions, particularly the aeroplane skin temperature and the rate of precipitation being 


encountered. 


5.4.44 At the completion of aeroplane de-icing/anti-icing, the pilot-in-command will be provided with the following 
information: 


a) fluid type; 

b)  fluid/water ratio (Type Il, III or IV only); 

c) start time of the final anti-icing application; and 

d) confirmation that the aeroplane is in compliance with the clean aircraft concept. 
This basic information will assist the pilot-in-command in estimating an appropriate holdover time from the range 
provided in the operator’s table. The holdover time begins with the start of the final de-icing/anti-icing application and 
ends after an elapsed time equal to the appropriate holdover time chosen by the pilot-in-command. 
Updating of holdover time guidelines and de-icing/anti-icing procedures 
5.4.45 Holdover times and de-icing/anti-icing procedures are continually updated by an international group of 
experts under the auspices of the SAE G-12 Committee on Aircraft Ground De-icing/Anti-icing through its Hold-over 


Time Subcommittee. This group of experts is composed of representatives of the world’s airlines, anti-icing fluid 
manufacturers, aircraft manufacturers, aviation regulatory authorities and research organizations. 
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5.4.46 De-icing/anti-icing fluids are qualified to the appropriate specification by certified laboratories. Qualified 
fluids are tested jointly by the United States Federal Aviation Administration (FAA) and Transport Canada to establish 
the fluid endurance time data, from which the holdover time guidelines are generated by the Holdover Time 
Subcommittee. The de-icing/anti-icing procedures are developed by the Methods Subcommittee who recommend their 
approval. The holdover time guidelines and procedures are approved for use by the SAE Aerospace Council. The 
approved documents are published by: 


a) Transport Canada in an Advisory Circular; 


b) the United States Federal Aviation Administration in a Flight Standards Information Bulletin for Air 
Transportation (FSAT); 


c) the SAE in Aerospace Recommended Procedure ARP 4737; and 

d) the ISO in ISO 11076. 
5.4.47 The FAA and Transport Canada publications are published annually and are usually available prior to the 
start of winter in the northern hemisphere. The SAE and ISO publications appear later. The FAA and Transport Canada 
also publish a list of the qualified de-icing/anti-icing fluids, together with holdover time guidelines for specific fluids that 


have superior performance to the generic tables. 


5.4.48 Following are websites where information on de-icing and anti-icing can be found: 


a) FAA: www.faa.gov/about/office_org/headquarters_offices/avs/offices/afs/afs200/ 


b) Transport Canada: www.tc.gc.ca/CivilAviation/commerce/HoldoverTime/menu.htm 
and www.tc.gc.ca/tdc/projects/air/f/tables.htm 


c) Society of Automotive Engineers: www.sae.org 
d) Association of European Airlines: www.aea.be/press/publications 


e) ICAO: www.icao.int/groundice 


The ICAO site provides links to other sites where up-to-date information can be obtained. Furthermore, search engines 
on the internet are useful to find up to date information on de-icing by typing “de-icing” or “hold over time” in the search 
field. 


Investigating accidents in which ground icing is a suspected factor 


5.4.49 Potential effects of frost contaminants on critical airplane surfaces or equipment should be evaluated when 
degraded performance, stability or control of an aircraft shortly after takeoff is coupled with freezing or subfreezing 
temperatures and small temperature dew-point spreads or standing water or slush. The investigation should include the 
items listed below. 
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Inspections used to determine the need for de-icing and anti-icing 
5.4.50 Some of the factors to be examined in this include: 

a) existence of formal procedures; 

b) adequacy of procedures to detect icing in critical areas; 


c) visibility of critical areas to include the effects of adequacy of lighting, viewing angles and reduced 
visibility from inside the cabin due to wet and/or scratched windows; and 


d) training of ground and flight crew performing the inspections. 


Procedures used to de-ice and anti-ice the aircraft 
5.4.51 Some of the factors to be examined in this area include: 
a) the existence of formal procedures for de-icing and anti-icing the aircraft; and 
b) compliance with procedures for de-icing and anti-icing the aircraft including the sequence followed to 
de-ice and anti-ice the various surfaces, avoidance of surface areas which should not be exposed to 
anti-icing fluids, training of ground crews in de-icing and anti-icing procedures and communication of 
critical information concerning de-icing or anti-icing to the flight crew. 
The type of fluid and concentrations in the solution used to de-ice and anti-ice the aircraft 
5.4.52 Some of the factors to be examined in this area include: 


a) procedures to ensure the quality of the fluids being used; and 


b) procedures to ensure the accuracy of the mixtures used in the solutions applied to the aircraft. 


The amount of additional frozen contaminants which the airplane could have collected prior to takeoff 
5.4.53 Some of the factors to be examined in this area include: 


a) the type, temperature and the rate of the frozen precipitation accumulating/collecting on the aircraft 
surfaces; 


b) the length of time from the beginning of the de-icing or anti-icing procedures performed on the aircraft; 
and 


c) other factors which could affect the collection of additional frozen contaminants on airplane surfaces 
i.e. wind direction and velocity, cloud cover/sunlight, influence of jet exhausts on melting and freezing 
of dry snow, presence of surface water which could splash/be blown into critical areas, use of reverse 
thrust which could blow contaminants onto or melt dry snow on critical areas. 
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The criteria used by the ground and flight crews to determine that the aircraft 
was still free of frozen contaminants prior to takeoff 


5.4.54 Some of the factors to be examined in this area include: 
a) existence of criteria for determining the need for additional de-icing or anti-icing; 
b) adequacy of criteria for determining the need for additional de-icing or anti-icing; 
c) adequacy of ground and flight crew training on need for additional de-icing or anti-icing; and 


d) implementation of procedures for determining the need for additional de-icing or anti-icing. 


In-flight icing 


5.4.55 In flight icing can be divided into two types: structural and engine ice. Structural ice degrades the airplane 
performance when supercooled water droplets impinge on aircraft surfaces. Ice build-ups can then degrade lift 
production, increase drag, reduce propeller efficiency, increase airplane weight and, if shed by the structure on which it 
forms, cause damage to systems or structure. Engine ice can degrade thrust or power production by the power plant by 
starving it of air. 


Structural icing 


5.4.56 The hazards associated with in-flight structural icing can be divided into two general areas; aerodynamic 
factors and system operations. Of the two, aerodynamic factors is probably the most obvious. Aircraft in flight are acted 
on by three forces: the aerodynamic force, thrust and weight. Icing in-flight can affect all three. In addition, in-flight icing 
can dramatically influence the pitching moments generated by the airflow over aircraft surfaces. If de-icing or anti-icing 
equipment is not available or used, flight into icing conditions can degrade the performance of various aircraft systems. 
Some of the more obvious are the engine and the pitot static system. In addition, the performance of communication and 
navigation systems which rely on external antennas can also be influenced by the presence of ice. Furthermore, 
structural icing on windscreens can degrade the flight crew’s view of the external environment. 


5.4.57 Direct evidence of in-flight icing is extremely volatile. By the time the investigators arrive on scene, the ice 
will most probably have disappeared due to natural melting or sublimation, accelerated melting in a post-crash fire, or 
separation from the structure during the ground impact. Because of the fleeting nature of this evidence, investigators 
need to have a good understanding of when in-flight icing can occur and how it can effect an aircraft and its systems. 


5.4.58 Two conditions are necessary for structural ice to form on the exterior of an in-flight aircraft. First, there 
must be liquid moisture in the air. Second, ambient air and aircraft surface temperatures must be below freezing. 
Although water can remain a liquid as low as minus 40°C, most icing occurs between minus 20°C and 0°C. There are 
two typical environments which satisfy these requirements: freezing rain or drizzle and supercooled droplets of liquid 
water. The freezing rain or drizzle can most often be found in the clear air of a cold air mass which is below an overriding 
warm air mass. These conditions can be found along the cold side of a warm front or occasionally behind a slow moving 
cold front. Supercooled water droplets are found in clouds, in fact they are clouds. The supercooled droplets range in 
size from 5 to 50 microns and are associated with cumuliform clouds or dense layers of nimbostratus clouds. The larger 
droplets are associated with cumuliform clouds while the nimbostratus clouds yield smaller droplets. The size and 
temperature of the water droplet determines the rate at which it transitions from liquid water to crystalline ice; the smaller 
and colder, the faster the transition; the larger and warmer, the slower the transition. The size and temperature of the 
droplets is also a factor in determining whether the water freezes into a relatively rough surfaced, opaque and milky 
appearing rime ice, or a relatively smooth and translucent clear ice, or a mixture of the two. 
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5.4.59 Rime ice is normally associated with small, very cold droplets which freeze immediately on contact with the 
airplane surface. Rime ice tends to accumulate first at leading edge stagnation points and is primarily confined to the 
leading edges of the structure. If allowed to build up to any significant amount, the rough shape tends to distort the 
design shape of aerodynamic structures, greatly altering the intended airflow around the structure. Because of air which 
is entrained in the ice, rime ice is “milky” in colour, has a lower density and is generally weaker than clear ice. 


5.4.60 Clear ice is normally associated with larger droplets which are at or just a few degrees below freezing. 
Because these droplets take longer to freeze, they can flow from the airplane’s leading edges as they freeze. This forms 
a sheet of ice which closely conforms to the original shape of the surface. Because of the larger droplet size and the 
greater liquid water content associated with the environment in which clear ice forms, it does not entrain air, it has a 
higher density than rime ice and is also stronger. 


5.4.61 The rate at which ice accumulates on an aircraft varies with the size of the liquid water droplets, the 
amount of liquid water per unit volume of air, the speed at which the airplane surfaces are moving through the air, and 
the size of the leading edge of the surface moving through the air. Smaller droplets tend to follow the airstream and most 
pass over the aircraft surfaces. The momentum of larger droplets impedes their movement with the air and they collide 
with the aircraft surfaces. 


5.4.62 There are no requirements to certify an aircraft in freezing rain. The more droplets in a cubic foot of air, the 
more will collide with the aircraft surfaces. Furthermore, the faster an aircraft moves, the greater volume swept out by 
the surfaces. This factor has some limits, however. As aircraft move faster, the leading edges of their surfaces are 
heated by the compression of the air near the stagnation points. This can heat the surfaces to temperatures where ice 
cannot form. Finally, thin structures tend to produce the least disturbance of air in front of them, so the droplets have 
less opportunity to be carried by the airflow out of the way of oncoming surfaces. Ice will therefore collect fastest on the 
thinnest structures such as wire antennas, temperature probes and pitot tubes; slightly thicker objects, such as struts 
and horizontal and vertical stabilizers, will collect ice more slowly and on the thickest structures, including wing and 
fuselage leading edges, engine nacelles, and propeller leading edges, ice will collect most slowly. 


5.4.63 There can be synergistic effects when two or more factors combine. For instance, aircraft propellers move 
much faster than the aircraft itself. They are sweeping out a large volume of air and are relatively thin. They contact 
more water droplets and may therefore accumulate ice faster than other surfaces. Pilots looking out at an easily 
observable leading edge of a wing may be fooled into believing that the accumulation there is representative of 
accumulations elsewhere. In fact, considerably more ice may have formed, for example, on the leading edge of the 
horizontal tail, a condition which is more critical than ice on the wings when it comes to landing. 


5.4.64 When low wing aircraft fly at high angles of attack, clear ice can collect on lower wing surfaces where it is 
out of sight of the pilot. 

Hazardous effects of structural in-flight icing 

5.4.65 The aerodynamic effects of in-flight structural icing are primarily a leading edge problem. The shape of the 
leading edge ice will depend on the temperature and size of the water droplets and the temperature of the surface onto 


which they freeze. 


a) Two ragged ridges of ice form when large water droplets freeze on leading edges at -1°C to -4°C. 
Aerodynamically, this shape has the most severe effects on airfoil performance. 


b) A single ragged ridge of ice forms when smaller water droplets freeze almost immediately on leading 
edges at -4°C to -10°C. This shape has severe effects on the airfoil’s performance. 
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c) A frost-like ridge of rime ice forms along the stagnation point when very small water droplets freeze on 
contact with leading edges at temperatures below -10°C. This shape has severe effects on the airfoil’s 
performance. 


d) When large water droplets freeze slowly, flowing aft before freezing, a smooth surface of clear ice 
forms on the surface. This shape has the smallest effect on the airfoil’s aerodynamic performance. 


5.4.66 The shape of the clear ice which forms at or just below freezing temperatures follows the structure’s shape 
closely and therefore does not have a pronounced affect on aerodynamics. However, since it is denser and accumulates 
at a faster rate, it can add significant weight to the aircraft, increasing induced drag and slowing the aircraft. In addition, it 
can cover antennas and radome, interfering with transmission and reception, and break off in sheets which will be 
carried aft and can cause damage. 


5.4.67 Aerodynamically, the double horn shape will have the greatest impact. It can cause the greatest decrease 
in the coefficient of lift (and therefore stall speed), and the largest increase in parasite drag. This shape can also cause 
the stall to be more abrupt. A small increase in angle of attack will produce a large increase in coefficient of lift. It can 
also cause an asymmetric stall: one wing stalled while the other is not. The single horn formation, which occurs at 
slightly lower temperature, and the more classic rime ice formation, which occurs at even lower temperatures will, to a 
lesser degree, cause a reduction in maximum coefficient of lift and an increase in drag. 


5.4.68 As mentioned earlier, ice can accumulate rapidly on propellers, decreasing both propeller efficiency and 
thrust. In addition to the hazards associated with loss of thrust, it is likely that ice will be shed from the propellers 
asymmetrically. The resulting vibrations and pounding of the shed ice on the fuselage will, at the very least, be 
disconcerting to the crew and passengers. At worst, the vibration could cause damage to the engine and its mounts. 


5.4.69 The formation of structural ice on lifting surfaces can adversely affect aircraft stability, the most dramatic 
effect of which is the stall of the horizontal tail. Lift generated by the horizontal tail (which is in the downward direction) 
balances the weight of the airplane whose centre of gravity is located forward of the wing’s centre of lift. If the horizontal 
tail’s angle of attack exceeds its stall angle of attack, the horizontal tail will stall, the balance is upset and nose will pitch 
down. If the nose down pitching is not arrested, the airplane’s attitude can quickly reach vertical. If the tail stall occurs 
while the airplane is making its approach to landing, collision with the ground at an extremely nose-low attitude and ata 
speed well above stall speed is likely. 


5.4.70 One condition which can increase the probability of a horizontal tail stall because of ice on leading edges is 
the lowering of wing flaps. When wing flaps are lowered, the downwash angle behind the wing will normally increase, 
which increases the angle of attack of the horizontal stabilizer. Not all airplanes are equally susceptible to tail stalls. The 
effect of the downwash on the tail is a function of the wing and horizontal tail locations. High wing, low tail configurations 
are more likely to place the horizontal in the wing’s downwash. Low wing, high tail (“T” tail) configurations are less likely 
to have the horizontal tail in the wing’s downwash. 


5.4.71 There are other ways the horizontal tail’s angle of attack can be increased beyond its stall angle of attack. 
If the wing’s angle of attack is increased to high coefficient of lifts, its downwash angle will increase, increasing the 
horizontal tail’s angle of attack. Flying at high speeds will also increase the horizontal tail’s angle of attack as the 
airplane flies at lower pitch attitudes. Since a wing with a positive camber will develop a nose-down pitching moment 
which increases as a function of dynamic pressure, the downward lift produced by the tail must steadily increase as 
speed increases. 


5.4.72 One other factor which influences the hazards associated with the stall of the horizontal tail is the change 
in the pressure pattern on the horizontal tail when it stalls. The pressure pattern will change so that the aerodynamic 
pressure over the tail will naturally cause the elevator to want to move toward the trailing edge down position. For 
hydraulically powered flight control systems which do not allow forces on the control surfaces to cause movement of the 
control surface, this does not pose any additional problems. The elevator is locked in position by the hydraulic actuator. 


Ill-5-48 Manual of Aircraft Accident and Incident Investigation 





However, in aircraft with non-powered systems, the pressures on the elevator can be strong enough to over-power the 
efforts of the pilot, forcing the yoke to the full forward position. Unless the crew is able to return the yoke to the nose-up 
position, safe recovery is unlikely. 


5.4.73 Some of the questions which need to be answered following an accident caused by leading edge ice- 
induced stalling of the horizontal tail include the failure of the crew to both detect and eliminate tail ice and the extent of 
the crew’s knowledge of the hazards associated with tail icing. 


5.4.74 Wing frost and ice on the upper surfaces of swept wing aircraft will increase the thickness and reduce the 
energy of the boundary layer air as it naturally tends to move outboard. The thickened, low energy boundary near the 
wing tips will tend to stall sooner than normal. If the wing tips stall before the rest of the wing, the centre of lift will tend to 
move forward, causing a nose-up pitching moment just when it is not needed: during the stall. 


5.4.75 Structural icing has also led to problems with the crew's movement of flight controls. Surface contamination 
can freeze in locations which prevent surface movement. This can be caused by ice which formed on the ground, liquid 
water which collected on the ground but froze in flight or ice which melted on the leading edge but flowed back and re- 
froze. Water which freezes inside flight controls can also upset the mass balancing necessary to prevent flutter. Water 
trapped internally in unheated flight cable or actuator areas can freeze in-flight causing flight control malfunctions. 
Furthermore, wheel brakes can accumulate water or slush, which can freeze at higher altitudes. This can cause the 
wheels to lock in position, causing them to blow out on touchdown. 


Engine ice 


5.4.76 In addition to the structural type of icing which can degrade the thrust producing lift of propellers, icing can 
interfere with a reciprocating engine’s induction system or damage critical components in a turbo-jet engine. Aircraft 
engine icing is normally divided into two subcategories: induction icing and intake icing. Induction icing refers to ice 
which develops within a reciprocating engine’s carburettor when cooling associated with the venturi effects and fuel 
evaporation causes condensation and freezing or deposition. This type of icing occurs most commonly in clear air and at 
ambient air temperatures well above freezing. It requires neither liquid water in the atmosphere or freezing ambient 
temperatures. 


5.4.77 Intake icing is a specific type of structural ice which forms on the air inlets of either reciprocating or jet 
engines. Both types of engine icing can block the engine’s air supply, reducing power or thrust available. In addition, 
inlet ice on jet engines can break off, damaging compressor blades. 


5.4.78 Loss of power by a reciprocating engine can be caused when ice forms in the induction system, blocking 
the source of air to the engine. Although this blockage can occur in atmospheric conditions similar to those which allow 
structural ice to form, induction icing can also occur in clear air and when temperatures are well above freezing 
conditions. Significant ice can occur when supercooled water makes contact with components of the engine air induction 
system which are cooled to below freezing temperatures. This requires the same condition which fosters the growth of 
structural ice. In fact, it is structural ice that forms in areas which block the flow of carburettor air to the engine. This ice 
can form on the air inlets, air filters, and on the structural components within the induction system or where increases in 
local velocity cause a drop in local ambient static pressure and an associated drop in temperature. If the drop in 
temperature is greater than the temperature-dew point spread, moisture in the air will condense. If the temperature of 
the surface is below freezing, the moisture can either freeze when it contacts the surface or form directly out of the air as 
frost. This can occur in the carburettor’s venturi or around a partially closed throttle valve. The more the valve is closed, 
the greater the velocity necessary to keep a constant mass rate of airflow. A fully open throttle valve produces little 
temperature drop. Maximum temperature drops from the venturi effects are normally small (in the area of 5°C) but can 
allow ice to form when inlet temperatures are slightly above freezing. A much greater drop in temperature is associated 
with the evaporation of fuel where it is introduced into the carburettor. The energy necessary to turn the liquid fuel into its 
gaseous form is absorbed from the air, cooling it as much as 20° to 40°C. Again, if the temperature-dew point spread is 
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sufficiently small, water vapour in the air will condense. If the temperature is below freezing, ice will form on structures 
within the induction system. As the passage for the fuel-air mixture to the engine becomes smaller, the power output of 
the engine is decreased. Manifold pressure and, for aircraft with fixed-pitch propellers, RPM will drop. 


5.4.79 The engine can also begin to run rough. As ice continues to grow, the opening for passage of the fuel-air 
mixture can change sufficiently to preclude engine operation and the engine will quit. The evidence concerning the 
existence of engine icing is primarily circumstantial. Weather forecasts and observations, especially those by pilots flying 
airplanes with similar engine configurations, may provide evidence concerning the possibility of engine ice. However, the 
location of the induction system on the engine can affect the temperature of the induction air, and variances between 
engine types as well as engine operating conditions can spell the difference between ice and no ice. When investigating 
potential induction icing accidents, the availability and use of anti-ice features such as carburettor heat (for venturi, 
evaporation and impact ice within the induction system) and alternate air sources (for impact ice on induction air inlets 
and filters) should be examined. The position of cockpit controls and the mechanical devices they operate need to be 
determined and documented. Functional checks, where possible, should also be performed. The assistance of an 
engine technician, experienced in the specific engine type and installation involved is vital. There are also a number of 
carburettor ice (venturi and evaporation) detection systems on the market. If one of these systems was installed, its 
operational status and any post-crash indications of the existence of ice should be ascertained. 


5.4.80 In-flight ice affects jet engines differently than reciprocating engines. For the most part, the problems 
involve damage to rotating components or disruption of the airflow through the engine and accompanying engine stalls 
or stagnations. Structural ice which forms ahead of or in the inlets can be shed in slabs which, if they enter the engine, 
can cause damage to the engine and loss of thrust. In addition, if the slabs disrupt the airflow across the compressor 
face, compressor stall, which results in engine flameouts or stagnation, can also occur. The formation of ice on inlet 
guide vanes, stators, and compressor blades can result in reduced clearance and interference damage. Post-crash 
evidence may include FOD-type damage. Engine stagnation can lead to excessive temperatures in the engine’s turbine 
section and associated heat damage. Finally, modern jet engines rely on pitot-static pressure information from the 
engine inlet. If the sources of this pitot-static pressure information are iced over, engine operation and thrust output can 
be affected. Evaluation of FDR and CVR data may provide clues concerning engine RPM, thrust produced and 
operation of de-ice or anti-ice systems. 


5.4.81 When compared to other leading edge surfaces on the airplane, the leading edge of engine inlet ducts and 
inlet guide vanes are relatively thin and therefore relatively good ice collectors. In addition, the low static pressures in the 
engine inlets will be accompanied by lower than ambient temperatures. If small ambient temperature-dew point spreads 
exist, frost can form on inlet duct surfaces whose surface temperatures are below freezing. 


Effect of in-flight icing on other systems 


5.4.82 The effects of in-flight icing go well beyond aerodynamics and thrust. The blockage of the static port of an 
aircraft can cause a multitude of problems. If the pitot pressure is used by the airspeed indicator, an increase in altitude 
will also cause the indicated airspeed to increase. If the pilot attempts to control the airspeed indication by raising the 
nose, the airspeed indication will increase further while the actual airspeed is decreasing. The stall and spin of a 
commercial airliner, despite its experienced crew, was attributed to this series of events. On the other hand, loss of 
altitude will cause an airspeed indicator to indicate lower than actual speeds if the airspeed indicator’s pitot source is 
blocked with ice. If the pilot attempts to correct the low airspeed indication by lowering the nose, indicated airspeed will 
decrease further while the aircraft actual speed is increasing. The excessively high airspeeds which result can cause 
structural failure due to high dynamic pressures, aeroelastic failures (flutter, wing divergence in torsion and control 
reversal) or over G due to manoeuvring loads at very high airspeeds. If the pitot source is used by the aircraft stability 
augmentation system, erroneous controls may lead to pilot-induced oscillations and resulting over G, loss of control and 
subsequent collision with the ground. The accumulation of ice on communication and navigation antennas can degrade 
the effectiveness of the transmission or reception of the antennas. The antenna may also fail structurally when the drag 
created by the ice exceeds the antenna’s static strength or the ice creates shapes which are aerodynamically unstable 
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and dynamic loads cause their structural failure. The build-up of leading edge wing ice may also be masked if the 
autopilot is engaged, providing the small aileron inputs necessary to keep the wings level. If the autopilot is disengaged, 
either by the pilot or on its own when its authority is exceeded by aerodynamic forces, the aircraft may experience a 
sudden roll-off in the direction of the most contaminated wing. A large aileron input could cause wingtip stall. 


Investigating accidents in which in-flight icing is a suspected factor 


5.4.83 When investigating accidents involving aircraft icing, the investigator needs to examine not only what 
happened, but why it happened. These are some of the questions that may need to be answered: 


a) Why did the pilot fly into icing conditions which the aircraft was not able to safely penetrate? 
b) Did the pilot seek a pre-flight weather briefing? 

c) Ifa briefing was provided, was it accurate? 

d) Did the pilot seek or did air traffic control provide updates of significant weather? 

e) Did the pilot know that ice was accumulating on the critical aircraft surfaces? 


5.4.84 Another series of questions address aircraft systems and their ability to detect, prevent or eliminate the 
accumulation of ice: 


a) Were anti-icing and de-icing systems functional and effective? 


b) Did the crew know how and when to operate anti-icing and de-icing systems such as airfoil leading 
edge boots, electrically and engine bleed air-heated surfaces, and glycol systems? 


c) Were the anti-icing or de-icing systems installed on the aircraft capable of functioning in the icing 
environment encountered by the aircraft? 


d) Was the aircraft flown at a higher or lower than normal angle-of-attack, allowing ice to accumulate on 
unprotected airfoil surfaces which were aft of the leading edge of de-icing devices? 


5.4.85 Another issue concerning the ability of aircraft to operate in icing conditions is their certification in 


accordance with stated provisions. Although some aviators believe otherwise, no aircraft is certified to operate 
continuously in severe icing. 


5.5 SEAPLANE OPERATIONS 


5.5.1 The following paragraphs are included to supplement or highlight conventional investigation techniques, 
and describe common seaplane risk factors based on various phases of flight. 


General 


5.5.2 Seaplanes are usually only slightly different from other aircraft, and where one is involved in an accident on 
land you would investigate the accident in the same manner as other fixed-wing aircraft accidents. Take into account 
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what role the floats may have played, e.g. energy absorption and drag. If the occurrence involves water operations 
however, one must also consider the operational and technical aspects unique to the seaplane environment. 


5.5.3 The most obvious differences are the absence of surface scars to help with the direction of flight at impact, 
and that the water surface will have likely changed (waves or no waves) by the time the investigator gets to the site. 


5.5.4 The attitude of the aircraft at impact can often be determined by the water impact damage on the aircraft. 
However, there will be little or no water impact damage in low speed, low force accidents. (See Figure Ill-5-1.) 
Survivability 


5.5.5 Losses of life in seaplane accidents are often caused by drowning due to the inability of the occupants to 
escape the wreckage. Autopsies will determine the cause of death. 


5.5.6 Take note of seat belts and shoulder restraints, attached or not, before retrieving the bodies. Also note life 
jacket locations, and if the exits are blocked. See Chapter 17 for a more complete discussion of evacuation and 
survivability investigation. 





Figure Ill-5-1. Water impact damage 
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Environmental issues 

5.5.7 Weather and water conditions may have a considerable effect on accident causation. Landing sites may be 
remote and normal weather reporting resources may not be available. Information on water and wind conditions directly 
affecting takeoff, landing, taxi, and docking operations are important for the investigation. Sources of environmental 
information include: 

a) lighthouse keepers; 

b) marine reports; 

c) boaters in the area; 

d) commercial seaplane operators; 


e) long-time residents in the area; and 


f) photographs and video footage. 


Taxiing accidents 


5.5.8 In the past, seaplanes have capsized while taxiing because of a combination of adverse conditions. These 
conditions include: 


a) excessive aircraft weight and/or incorrect loading (C of G); 


b) an uneven manoeuvring surface caused by waves or swells. (Waves created by surface vessels can 
also cause problems); and 


c) incorrect pilot technique for turning into or out of wind on the water. Using too much power for turning 
can submerge the downwind float resulting in capsize. 


Take-off accidents 


5.5.9 Confined spaces take-offs. One of the most common causes of water take-off occurrences is the pilot 
attempting to take off from a confined water surface with a heavy or overloaded aircraft. Confined area operations may 
also be adversely affected by wind conditions. 


5.5.10 Collisions with logs/boats. Consider searching the take-off and landing run for submerged objects; logs, for 
example, can sink or float away after collision, however, the floats should show evidence of impact with an object. 


5.5.11 Excess weight and shifts of centre of gravity (C of G). Inspect the watertight integrity of the float access 
covers and the float undersurfaces for cuts and loose rivets. Water entering a perforated or a leaking float can 
appreciably increase the aircraft weight, particularly on high displacement floats. Any high weight problem may be 
aggravated by rapid and drastic changes of the C of G caused by water movement in the floats during the take-off run. 


5.5.12 Ask witnesses to describe the float waterline. This can give a good indication of both the weight and the 
location of the C of G. A long water taxi can compound a leaking float problem, and swells can cause the floats to take 
on water, as float plugs are often missing. 
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5.5.13 Incorrect float installations. Evaluate the type of floats being used on the aircraft. Large floats may 
seriously effect aircraft directional stability and control at low airspeeds. Normally aircraft floats are installed in 
accordance with a supplement type certificate (STC). 


5.5.14 Float rigging (Figures III-5-2 and III-5-3). Incorrectly rigged floats can considerably lengthen the take-off 
distance. If the rigging is intact after the occurrence, determine if the floats were properly “boxed” and the “throat angle” 
correct (usually about 2 degrees). If the floats are not intact, try to reconstruct the rigging conditions existing before the 
occurrence. 


5.5.15 Aircraft performance problems. 


a) Improper use of ancillary controls. Partially or fully lowered wheels or the misuse of flaps will adversely 
affect aircraft take-off performance. 


b) Magneto switches. One method used by pilots to reduce water-taxi speed is to switch off one of the 
magnetos to slow the engine below the normal idling speed. Another technique is to turn the engine 
on and off with the magneto switch. If the pilot does not return the switch to "both" before take-off, a 
reduction of power may result which could be significant in conditions requiring maximum engine and 
aircraft performance. 




















Figure Ill-5-2. “Boxed” is the square alignment of the floats. 
Many float-equipped aircraft have boxing wires and these are strung 
between the floats and the spreader bars in an “X” pattern. 
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Figure Ill-5-3. “Throat angle” is the difference between the angle of the top deck 
of the float and the angle of incidence of the wing. 


Ill-5-54 


Manual of Aircraft Accident and Incident Investigation 





c) 


qd) 


e) 


f) 


Fuel-related problems. Fuel contamination is a common cause of seaplane power loss on take-off. If 
possible, take a fuel sample from both the aircraft and the fueling source. Determine if a proper fuel 
sampling procedure was carried out. 


Glassy water effects. (Figure II|-5-4). The lack of wind normally associated with glassy water increases 
the take-off distance. Additionally, the aircraft will experience more difficulty breaking free from the 
water because of surface friction and tension, which further contributes to a longer take-off distance. 


Glassy water also adversely affects a pilot’s depth perception during take-off and initial climb and, in 
some instances, a pilot may inadvertently descend after takeoff to strike the surface of the water in a 
nose-low attitude. 


Wind conditions. Changes to the aerodynamic lift caused by wind shift relative to the wing surfaces is 
a common condition when operating in water bodies that are in the vicinity of a confluence of multiple 
river valleys. 


Lifting off at too low an airspeed in cross-wind conditions may allow the aircraft to develop drift, and 
touch down with sideways motion on the down-wind float; this motion may cause an aircraft upset. 


External loads. If the aircraft was carrying external loads, consider their effect on aircraft performance. 
Aircraft may require special testing or a Supplemental Type Certificate to carry external loads. 





Figure Ill-5-4. Glassy water 
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Landing accidents 


5.5.16 a) Improper landing configuration. A common cause of amphibious seaplane landing occurrences is the 
pilot attempting to land on water with the wheels extended. These occurrences often happen after the 
aircraft has departed a hard-surface runway and the pilot either does not retract the wheels after 
take-off or lowers the gear by habit. 


b) Hydrodynamic drag. Hydrodynamic drag increases as the square of the aircraft velocity at touchdown. 
Landing upstream in a river at too high a speed will increase the drag on the floats and tend to upset 
the aircraft on touchdown. 


c) Another type of landing occurrence that usually happens immediately at touchdown or shortly 
thereafter, is commonly known as "digging a float". This event can result from a pilot not maintaining 
adequate back pressure on the control column to keep the aircraft nose up as the floats touch the 
water surface. It can also happen when the aircraft touches down in a slight nose-down attitude. 


d) Glassy water. Glassy water presents a number of difficulties to floatplane pilots. Glassy water landings 
are more difficult because few and poor depth perception cues are available to the pilot (one cannot 
see the water, just a reflection). Any attempt by the pilot to judge a round-out height will likely fail 
under these conditions. As a result, the aircraft may strike the water with sufficient force to bend the 
floats sharply at the front spreader bar. The front of the floats may break off completely or the aircraft 
may sustain severe damage at the float attachment points. Unique approach procedures (and more 
landing area) are required under glassy water conditions. Pilots will try to land close and parallel to 
shore thereby being able to use the shore to judge their height. Another technique is to try and round 
out over the shore, weeds, etc. and let the aircraft settle onto the water, at a rate of descent less than 
100 feet per minute, after visual height reference is lost. This can easily add several thousand feet 
before touch-down. An inexperienced float pilot may get impatient and lower the nose to get closer to 
the water, that can’t be seen, and dig the floats into the water. 


5.5.17 Freezing of control cables. |In the Fall and early Spring, aircraft often operate in water conditions at or near 
the freezing point, and any water spray on the floats and tail surfaces of the aircraft may freeze. Apart from the ice 
increasing the weight of the aircraft, it disrupts the airflow over the flying surfaces, and may accumulate on and jam the 
water rudder cables or flight controls. 


5.5.18 Corrosion. Aircraft operating in a salt-water environment are more susceptible to corrosion than those in 
salt-free conditions. Unless washed regularly with fresh water and meticulously inspected, these aircraft can develop 
corrosion-initiated failures in very short periods. 


5.5.19 Stress corrosion cracking. Float fittings and skins take a beating and sometimes crack and break. Check 
that the right materials and dimensions were used. 


5.6 BIRD/WILDLIFE INVESTIGATION 


5.6.1 Whenever an accident or an incident involves an aircraft striking a bird or other wildlife, the investigator 
should add analysis of the event with any prevention efforts meant to reduce the likelihood of such a strike. While most 
discussion in this section will deal with strikes by birds, the same methodology should be used for whatever animal is in 
evidence. Care should be taken when looking for evidence of a birdstrike as the evidence remaining may be minimal. 
However, small birds can cause great damage to aircraft. 
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5.6.2 Even if the point-of-impact causing the most damage is readily identifiable, investigators should check all 
other areas on the aircraft for additional strikes. The total number of bird impacts is important in order to evaluate 
flocking characteristics. 
5.6.3 Whenever a ground fire is present, evidence of bird remains may be best detected by scent. Burning 
feathers or bird flesh may be detected by the “sniff test” well before any physical evidence is found. 
Obtaining bird/wildlife evidence 

5.6.4 Whenever possible, evidence of a bird or other wildlife strike should be collected and referred to experts for 
identification. To the maximum extent possible, evidence should not be cleaned. The best information, both from an 
analysis point of view and from a shipping point of view, comes from “non-fleshy” remains. Investigators should attempt 
to collect the following: 

a) all feather material from aircraft; 

b) all feathers found on ground; and 

c) non-fleshy remains: 

1) beaks; 


2) talons; 


3) feathers; 


4) fur; and 
5) teeth. 
5.6.5 Even with minimal evidence, some valuable remains can be recovered. Figures Ill-5-5 and _ Ill-5-6 


demonstrate a valuable technique for removing what appears to be nearly non-existent evidence. 


Securing bird evidence 


5.6.6 To avoid potential contamination of the evidence, bird evidence should be placed in clean plastic or vinyl 
bags, preferably with a lockable closure (Ziploc®). The bag should be sized to accommodate the sample rather than 
compressing or bending the sample to fit within the bag. If collecting tiny fragments such as those described in the 
figures above, the feathers may be placed in a plain white envelope beforehand. Feathers should never be cut prior to 
analysis. Care should also be taken to avoid contact with any adhesive surface. This may destroy or remove pin- 
feathers which, depending on the species, may be the most valuable for identification. For the same reason, never use 
tape to secure the feathers. While the adhesive properties are weaker, Post-It® notes (or similar) should also be avoided. 
Each evidence bag should be annotated with: 


a) date of the birdstrike; 
b) location of the strike; 


c) time of day, in local time; 
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Figure Ill-5-5. An investigator sprays a suspect area with clean water. 
He then wipes the area with a clean rag. 





Figure Ill-5-6. Bird evidence wiped from the aircraft 
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d) altitude, if in flight; 
e) extent of damage; and 


f) birds observed in the area. 


Bird identification 


5.6.7 Bird identification is essential if any prevention efforts are to be evaluated or taken as a result of safety 
investigations. Not all bird avoidance or elimination procedures will be effective for all species. Most States have 
naturalists that specialize in bird identification. State investigative agencies should have this information, by region if 
necessary, available for investigators. Most States have cooperative agreements for bird-hazard elimination and part of 
that effort is an identification process. In the United States, for example, all bird identification is handled by the 
Smithsonian Institution in Washington D.C. The Smithsonian Division of Birds is a member of the Avian Hazard Advisory 
team, so any data collected is made available for aviation bird strike prevention activities worldwide. 


Chapter 6 


AIRCRAFT PERFORMANCE INVESTIGATION 


6.1. INTRODUCTION 


6.1.1 The aircraft Performance Group normally will be responsible for gathering factual information and 
performing analyses related to the aircraft performance and to aircraft handling qualities. 


6.1.2 For the purpose of this chapter, performance investigation relates to determining and analyzing the path 
and attitude of the aircraft as it travelled through the air, or on the surface, prior to impact. The Performance Group may 
also be responsible for evaluating the aircraft’s motion following impact until the aircraft finally came to rest. Handling 
qualities investigation relates to determining and performing objective and subjective analyses of the aircraft's reaction to 
atmospheric conditions and pilot inputs, and automatic flight stability control interactions. 


6.1.3 In some cases, the Performance Group’s main task is simply to determine and document the path and 
attitude of the aircraft. However, the Performance Group’s tasks increase and become of special importance for mishaps 
involving: 

a) runway overruns and landing undershoots; 

b) loss or degradation of control in flight or on the ground; 

c) controlled flight into terrain (CFIT); 

d) runway incursions, mid-air collisions, avoidance manoeuvres, etc.; 

e) events involving stalls, overspeed, or unusual attitudes; 

f) windshear and wake turbulence encounters; 

g) events involving icing, microbursts, or other meteorological conditions; 


h) — flight automation malfunctions, misapplication; and 


i) engine failures. 


6.1.4 In these cases, the Performance Group must also determine and document how the aircraft actually 
performed or handled relative to how it was predicted to perform or handle; or how it could have performed with different 
piloting techniques, automation and system interactions or atmospheric conditions. 


6.1.5 This chapter will first introduce the typical tasks the Performance Group may be called upon to perform, 
and then describe the data sources and tools that may be available to perform those tasks. 
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6.2 PERFORMANCE GROUP ACTIVITIES 


General 


6.2.1 The Performance Group may participate in a wide range of activities depending on the particular mishap. 
In most cases, the first task of the Performance Group is to obtain data to determine and document the path and attitude 
of the aircraft leading up to the mishap. This may include its path in the air, while on the ground, or a combination of both. 
Depending on the particular mishap, the path of the aircraft after impact may also need to be determined to assist in the 
survival factors investigation. 


6.2.2 Some initial fact-gathering activities may be performed by the Performance Group leader prior to formally 
convening the entire group. As examples, coordination may be done with other group leaders to obtain flight data 
recorder data, recorded radar data, meteorological data, etc. The leader may also work with investigators at the accident 
site to document ground scars, impact with obstacles, and location of major aircraft components. 


6.2.3 The circumstance of the mishap will determine the various additional activities the Performance Group will 
need to accomplish, who needs to participate in the activities, and when they are to be performed. Typical Performance 
Group activities are described in greater detail below. 


Determining the flight or ground path of the aircraft 


6.2.4 One of the basic functions of the Performance Group is to document and analyze the motion of the aircraft 
through the air or on the surface. This includes not only the path of the aircraft through the air, but also the aircraft pitch, 
roll and yaw attitudes. If the aircraft was airborne, this information helps determine if the aircraft was under control at the 
time of impact. For ground events such as runway overruns or offside excursions, the information will be useful to 
compare actual stopping performance against predictions or to evaluate controllability. 


6.2.5 The Performance Group should attempt to correlate every piece of data available in reconstructing the 
motion of the aircraft. The overall quality of the performance investigation is improved when all potential sources of data 
are evaluated and correlated. Some data may be unreliable or conflicting. In that event, the Performance Group should 
use sound engineering judgment to select the best data sources. It is also wise to document which sources were not 
used, and the reasons they were not available or not used. 


Assessing handling qualities 


6.2.6 In accidents where some loss of control is evident or suspected, the Performance Group will need to 
evaluate the handling qualities, or stability and control, of the aircraft. (The terms “handling qualities” and “stability and 
control” will be used interchangeably for the remainder of this chapter.) 


6.2.7 Stability refers to the inherent nature of the aircraft to return to, or diverge from, its initial, trimmed condition 
following a disturbance. (If the aircraft is neutrally stable, it will have no tendency to return to or diverge from its initial 
condition following a disturbance.) Control refers to the response of the aircraft in motion away from its initial, trimmed 
condition. Stability is further defined in terms of static stability, and dynamic stability. Static stability refers to the initial 
tendency of the motion, while dynamic stability refers to the time history of the motion. Because most airplanes are 
symmetrical about their longitudinal axis, stability characteristics (and accident scenario analyses) can often be 
evaluated independently by examining only longitudinal motion or only lateral/directional motion. Airplane longitudinal 
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dynamic stability characteristics are usually described as the short period and the Phugoid modes.’ The short period 
mode reflects the rapid, highly damped pitch oscillation following a disturbance that occurs at nearly constant speed and 
altitude. The Phugoid mode is a long period, lightly damped (sometimes divergent) exchange of altitude and speed 
occurring at a nearly constant angle of attack. Some aspects that might adversely affect longitudinal stability are weight 
and balance, airspeed, and abrupt aircraft control inputs. 


6.2.8 Airplane lateral/directional stability is characterized by the Dutch Roll mode, a weak spiral mode, and 
highly-damped roll mode. The Dutch Roll mode is a lateral/directional oscillation of bank angle, heading and lateral 
acceleration, which is the result of sideslip and cross-coupling of the lateral and directional axes. A pronounced Dutch 
Roll mode is present in most large transport airplanes (especially swept-wing jets) and it can become undamped at high 
altitudes. Other aspects that might affect lateral/directional stability are engine malfunctions, icing, yaw control 
malfunctions, center of gravity and airspeed. 


6.2.9 The spiral mode refers to the airplane’s tendency to return to (or diverge from) wings level following an 
upset. The spiral mode may be stable or unstable, depending on the airplane configuration and flight condition. The 
spiral mode is usually of little consequence to the pilot because, even if unstable, it is normally easily controllable with 
minimal pilot attention. 


6.2.10 The roll mode is best described as the highly damped resistance to roll rate. Its importance is usually 
related only to roll response with lateral control inputs. The roll mode may be initiated normally by increasing the lift on 
one wing while/or decreasing the lift on the other wing. Other control options are related to asymmetric drag devices 
(spoilers or flaperons) along with lateral stability cross-coupling from yaw inputs. 


6.2.11 Stability and control characteristics in the normal flight regime with no system failures are usually well 
understood by the manufacturer as a result of testing necessary for design and certification. The manufacturer will also 
have some flight test data for conditions slightly beyond the certified operating limits, as these are required for 
certification. The Performance Group should obtain this data and independently analyze it if handling qualities are an 
issue in the accident. An approved training or the manufacturer's engineering simulator may be helpful in this regard. 
(The use of simulations for investigations will be discussed further below.) 


6.2.12 Detailed handling qualities analysis requires a high degree of expertise and effort and is usually a joint 
activity of the Performance and Operations, and perhaps the Human Performance (or human factors) groups. 


Performing wreckage trajectory analysis 


6.2.13 Trajectory analysis (determining the path or trajectory of an object separating from the aircraft) is a 
frequent task of the Performance Group. Although referred to as trajectory analysis, the activity can be considered part 
of the fact-gathering portion of the investigation as it involves performing repeatable, mathematical calculations, rather 
than interpreting the facts and circumstances of the accident. 


6.2.14 Trajectory analysis can be used in different ways. In one case the Performance Group may be asked to 
determine where to search for an object that departed the aircraft at a certain time, assuming that the path of the aircraft 
at the time is known. Trajectory analysis may also be used to determine the path of the airplane and breakup sequence 
in the air by analyzing the location of various pieces of wreckage on the ground. A third application might be to predict 
the path of an object striking the aircraft after falling off the aircraft. For example, to determine if a panel or piece of 
structural ice falling off the aircraft would be ingested by an engine. 





1. Different types of aircraft have different characteristic modes of motion. Only those modes typical of large transport airplanes are 
described in this chapter. 
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6.2.15 All of these examples would require knowing the initial path, drag and weight of the object, and the wind (or 
current, if water) and/or local air flow direction. In all likelihood, a computer programme would be necessary to efficiently 
perform the analysis, although simple analyses could be done “by hand”. 


Evaluating collisions (and near collisions) 


6.2.16 Because the Performance Group has responsibility for determining the path of the aircraft, it has a major 
role in investigating in-air and on-ground collisions and near-collisions. For collisions, this also involves thoroughly 
examining scratches, paint transfer and other impact evidence on the aircraft and any objects that were struck, to 
determine impact position and angles. Techniques for investigating collisions are contained elsewhere in this manual. 


6.2.17 The Performance Group may also be called on to work alone or with the Human Factors Group to perform 
visibility studies, that is, to determine if and when the pilots of two colliding aircraft could see each other or if the pilot(s) 
of the aircraft could see the object they collided with. Another task might be to determine when and what kind of 
avoidance manoeuvre could have averted the collision. 


Determining aerodynamic loads 


6.2.18 In the event of an airborne flight control system or structural failure or aircraft breakup, the Performance 
Group may be called to work with the Structures Group to calculate aerodynamic loads imparted on individual parts of 
the aircraft. Aerodynamic loads can sometimes be estimated with sufficient accuracy by simple, “preliminary design” 
methods. However, many times a more detailed analysis has to be performed. Normally the aircraft manufacturer can be 
of great assistance in this matter, as the manufacturer likely has acquired a substantial amount of flight-verified loads 
data during design and certification. 


6.2.19 The Performance Group may also be asked to calculate aerodynamic loads to help determine what did not 
happen. For example, it may be concluded that a certain angle-of-attack or sideslip was not exceeded or the structure 
would have failed. 


Evaluating aeroelasticity or flutter 


6.2.20 The interaction of structural deflections and aerodynamic forces and moments is referred to as 
aeroelasticity. The interactions can take place statically or dynamically. The Performance Group may need to 
understand aeroelastic characteristics for occurrences at high speeds. 


6.2.21 In large swept-wing aircraft, structural deflections as a result of aerodynamic and inertial loads can have a 
significant effect on handling qualities. As the wing bends upward under load, it normally twists increasingly nose-down 
from the wing root to tip. This changes the spanwise-load distribution and reduces the total lift relative to a rigid wing. In 
the same way, the horizontal tail will twist causing a decrease in longitudinal stability. The load on the horizontal tail 
deflects the aft fuselage of the airplane resulting in a change in the angle of attack at the tail. Weight distribution (fuel in 
the wings and payload in the fuselage) will result in deformation of the structure in proportion to the aircraft accelerations, 
which in turn will change aerodynamic characteristics. 


6.2.22 The deflection of a control surface will also tend to twist the structure it is attached to, reducing the control 
effectiveness relative to a rigid structure. For an outboard aileron on a high aspect ratio wing, the decrease in aileron 
effectiveness can be very significant, and can even lead to reversal of control effectiveness.” 





2. Normally the wing structure is designed to be rigid enough that aileron effectiveness will not reverse in the normal speed and load 
factor operating envelope. 
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6.2.23 The effect of the above-mentioned deflections can be evaluated in steady or quasi-steady state conditions. 
However, if a forcing function is present, like a movement of a control surface, and occurs near or at the natural 
frequency of the structure, flutter or control surface “buzz” can occur. Normally, stiffness, mass distribution and control 
surface balance keep flutter or buzz from occurring unless the normal flight envelope is considerably exceeded. 
However, structural damage, or slop in surface hinges or actuators can result in flutter or buzz inside the normal flight 
envelope. These conditions may also be the result of control surface mis-rigging following maintenance, or fatigue 
failures and structural degradation due to age or poor maintenance. 


6.2.24 Aeroelastic effects and flutter are complex subjects that take specific expertise to evaluate. The 
Performance Group will likely need to work closely with the structures group and the aircraft manufacturer for detailed 
analyses if they are issues in the mishap. 


Developing and performing simulations 


6.2.25 Often mishaps involving controllability problems cannot be evaluated by simple analyses. Aerodynamic 
simulations or actual flight tests must be conducted to adequately understand the problem. The Performance Group is 
normally responsible for planning and performing the studies involving aerodynamic simulations and flight tests. 


6.2.26 There are two basic types of flight simulators: the training simulator and the developmental or engineering 
simulator. The best simulator for the job will depend on the particular issue at hand. If the issue involves an airworthy 
airplane with a minor or very simple system failure, operating within the normal flight envelope, and if only limited output 
data is required, a training simulator may be the best solution. In the event of a more complex system failure, a flight 
regime near or exceeding the normal flight envelope (high speed, angle of attack, sideslip, rotational rates, etc.) or, if a 
significant amount of data needs to be recorded, an engineering or developmental simulator should be used. 


6.2.27 Especially in the case of the training simulator, it is imperative that the simulator, and perhaps the airframe 
manufacturer be consulted to fully understand the accuracy of the simulator model. Training simulators are required to 
be similar to the actual aircraft only for certain manoeuvres and failure conditions and may not represent the actual 
aircraft for other failures or conditions. It should also be pointed out that motion-based simulators do not provide 
acceleration or visual cues identical to those of the actual aircraft. The Performance Group must not only be aware of 
these limitations, but educate the other members of the investigation as to the accuracy and limits of the simulations. 


6.2.28 In some cases, the Performance Group will find that additional data needs to be collected and 
programmed into the simulator. Wind tunnel or computational fluid dynamics (CFD) data may need to be generated. 
Both of these sources have their limitations and require significant expenditures of time and money. As is the case with 
all investigation activities, the Performance Group must use care in determining if the questions they are trying to answer 
justify the expenditure of resources. This should be an ongoing process as other developments in the investigation may 
eliminate the need for, or amount of, data to be collected. 


Conducting aircraft tests (flight and ground testing) 


6.2.29 In certain cases, flight or ground testing is necessary to obtain information that cannot be obtained by 
analysis, wind tunnel testing, simulations, etc. Flight testing is usually a last resort because of the cost and lead time 
involved. Ground testing (taxi, takeoff, or stationary testing) is less expensive, but can still require considerable planning 
and lead time. 
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6.2.30 The best application of aircraft testing is to obtain data inside the flight envelope that can be used directly 
or extrapolated for simulator or other analysis of the accident, rather than attempt to repeat the accident manoeuvre. 
Obviously, there is a risk in trying to duplicate accident conditions too closely. Proposing testing outside of the aircraft's 
certified flight envelope adds a degree of complexity and risk that is rarely, if ever, justified.* It is desirable that aircraft 
testing be conducted only by the aircraft manufacturer or by an organization with ample expertise and experience in 
conducting the particular testing. 


Preparing computer animations 


6.2.31 The Performance Group is often involved in producing computer animations of the accident sequence. A 
major responsibility of the group is to insure that the animation accurately reflects the motion of the aircraft. There are 
cases where limitations in the available data (lack of data, sensor error, lag, insufficient sampling, etc.) require the 
Performance Group to manipulate the available data for use in the animation. It is essential that the Performance Group 
not only use mathematical rigor and sound engineering judgment in performing any necessary data manipulation, but 
clearly indicate in the animation that the data has been manipulated. 


Evaluating takeoff and landing performance 


6.2.32 Because a significant number of accidents occur during takeoff or landing, the Performance Group is often 
required to perform landing or takeoff distance analyses. These calculations are complex because they involve 
analyzing changing aerodynamic, propulsion and rolling friction forces. 


6.2.33 Although performance data in the pilot’s or operations manual may provide some useful information, the 
actual conditions of the accident will rarely be the same as assumed for the manual’s performance charts. A few knots’ 
difference in assumed rejected takeoff or touchdown speed, or a few seconds’ delay in speed brake deployment, can 
have a significant effect on stopping distance. Once again, the Performance Group should solicit the assistance of the 
aircraft manufacturer for more accurate analyses. 


6.3 DATA SOURCES 


General 


6.3.1 There are many potential sources of data that the Performance Group can use in the investigation. Much 
of the data is collected by other investigation groups. The Performance Group Chairperson should determine what data 
the Performance Group needs to collect itself, and ensure that the other investigation groups will gather the remaining 
needed data. 


6.3.2 The Performance Group should expect that the various sources of data will conflict to some extent. This is 
especially true of eyewitness accounts, which can be an unreliable source of information. All available data should be 
gathered and carefully examined to determine the most accurate and suitable data for analysis. Additional data may 
need to be obtained by flight or ground tests, simulations, etc., as is further described below. It is also a good practice to 
document which data, if any, were not used for final analysis and the reasons why. 





3. An exception to this rule may be for conditions that the manufacturer has already tested safely to provide a safety margin to the 
certified operating limits. 
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Flight data recorder 


6.3.3 Flight Data Recorder (FDR) data, of course, can be extremely useful for the Performance Group. However, 
each FDR parameter used must be evaluated for proper readout, reliability and accuracy. For example, flight control 
checks prior to flight might be helpful to confirm proper measurement of control surface deflections. 


6.3.4 Parameters should be checked for zeros and biases as well as proper scaling. When possible, a 
parameter should be cross-checked with other parameters. For example, accelerations can be integrated and cross- 
checked against speed or barometric altitude. The parameter should be checked for “reasonableness” as well. For 


example, the investigator should question a four “g” vertical acceleration reading if the aircraft is only capable of 
generating two g’s for the particular flight condition. 


6.3.5 It is also important for the performance investigator to know the source of each parameter, the rate at 
which it is sampled, measurement resolution and if filtering is applied. Some measurements may inherently be filtered or 
lag the actual thing to be measured. Some measurements may record the position of an actuator, not the actual surface 
being deflected. 


6.3.6 Finally, the performance investigator must also recognize the inherent limitation of sample rate and 
measurement resolution when interpreting FDR data. Each recorded data “point” is actually more like a “box” or range of 
data, the size of which is defined by sample rate and measurement accuracy and resolution. This is particularly relevant 
when attempting to determine the rate of change of a parameter. 


Quick access recorder 


6.3.7 Quick Access Recorder (QAR) data may survive the impact and can supplement data from the FDR. In 
some cases, the QAR will record many more parameters than the FDR. Even if a good FDR data set is obtained, the 
QAR should be examined to help check or to supplement the FDR data. The same issues of data accuracy, reliability, 
sample rate, resolution, etc. that apply to the use of FDR data apply also to QAR data. 


Aircraft system recorded data 


6.3.8 Aircraft system recorded data is becoming increasingly available from non-volatile memory (NVM). 
Although the NVM is generally not crash hardened, it often survives impact and some degree of heat exposure. The 
Performance Group should work with the Systems Group to understand what type of data may be available. Central 
maintenance systems, flight management systems, TCAS and many other systems can provide valuable data for the 
Systems and Performance Groups. 


ACARS‘* 


6.3.9 Many aircraft automatically transmit performance and maintenance data to satellite or ground stations for 
various maintenance purposes. The data is usually recorded for pre-determined phases of flight (for example takeoff, 
initial climb, cruise, etc.) and certain engine or system exceedences or failures. This data may be of limited value 
because it normally consists of “snapshots” of information, rather than a time history of data from the FDR or QAR. 





4. ARINC Communications Addressing and Reporting System 
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Recorded radar data 


6.3.10 Recorded radar data can be a valuable source of information for the Performance Group. It is important 
that the processing and accuracy of the data be thoroughly understood before it is used. The accuracy of the data is 
dependent on the type of radar and the distance between the aircraft and the radar antenna. Radar data displayed ona 
controller's radar scope is usually highly processed. Although the processed data may be useful to understand what the 
controller “saw” on the radar scope, the performance investigator should start with the “raw” data and understand all 
conversions, filtering, calculations, etc. that are applied to the data. It should be remembered that the source of altitude 
is normally from the aircraft’s transponder and not from the ground radar.° 


6.3.11 Very often there are multiple sets of radar data from independent radar sources (nearby approach controls, 
enroute control, military airport radar, etc.). In addition, airborne radar data may be available from military surveillance 
aircraft. Generally, all radar sources should be included to obtain the most accurate radar data. 


Impact marks 


6.3.12 Impact marks, both on the ground and on the wreckage, can provide valuable information to understand 
the aircraft attitude and path at impact. Impact marks (also referred to as witness marks and ground scars) should be 
thoroughly measured and documented as soon as possible, as they are often obscured during the investigation. Skid 
marks and tire tracks, of course, are particularly useful for overruns and runway excursions. 


6.3.13 Witness marks on analog instrument readings at the time of impact have been a traditional source of useful 
information. Many digital instruments have memory circuits, or illuminated portions that may record impact conditions 
and their circuitry needs to be handled carefully until it can be analyzed in the laboratory. 


Videos and surveillance cameras 


6.3.14 Increasingly common, videos recordings, mobile telephones and surveillance cameras provide video or still 
images and are useful to the performance investigator. Video tape from cameras in the wreckage should also be 
examined if found. The Performance Group should actively seek these potential sources of information. 


Eyewitness accounts 


6.3.15 Eyewitness accounts may be the least reliable source of information for the Performance Group but, 
evaluated properly, can provide some useful information. The performance investigator can sometimes determine 
information about the path of the airplane from the witness’s location and landmarks and obstructions to the view of the 
aircraft. Witness accounts should be used as secondary or confirming data if recorded data, as described above, is 
available.° Proper witness interview and interview analysis techniques are discussed elsewhere in this manual. 


Cockpit voice recorder 


6.3.16 The Cockpit Voice Recorder (CVR) will often provide information useful to the Performance Group. The 
sound of the nose gear over runway pavement seams can sometimes be used to determine aircraft speed. Engine 





5. Some military radar systems provide radar-based altitude. 
6. In some cases, the Performance Group will be required to evaluate reliable recorded data to help explain what witnesses have 
reported, rather than the other way around. 


Part Ill. Investigation 
Chapter 6. Aircraft Performance Investigation III-6-9 





sounds can be used to determine engine speed. Touchdown or liftoff times can often be obtained, as can the times for 
speed brake deployment, stall warning, altitude alerter, ground proximity warnings, radar altimeter callouts, etc. 


Airborne image recorders 


6.3.17 Airborne Image Recorders (AIR) may provide information valuable to the Performance Group. Events not 
recorded on other aircraft recorders (FDR, CVR, etc.) may be captured on the AIR. As of the time of this writing, AIRs 
have not been widely utilized, so the full extent of the information they can provide is not yet realized. 


Meteorological data 


6.3.18 Meteorological data can be of significant value to the Performance Group. Wind data is of particular value, 
as it is necessary to correlate aircraft motion relative to the air mass to aircraft motion relative to the ground. Some 
aircraft flight management systems compute wind speed and direction from inertial, airspeed and heading information. 
Whenever possible, the performance investigator should cross-check this with the wind reported by ground sources. 
Although the flight management system computed wind data may sometimes be more accurate, the performance 
investigator should thoroughly understand how it is derived before using it for analysis. 


6.3.19 Aircraft Performance investigation may identify unforeseen failure modes in new aircraft, or newly 
emerging failure modes due to fatigue in older aircraft. These may or may not be associated with the accident under 
investigation; however, these must be reported to the various agencies for separate action in order to prevent accidents. 
At a minimum, these concerns may focus additional research or maintenance inspections until these indicators can be 
confirmed or eliminated. 


Chapter 7 


FLIGHT RECORDERS 


7.1. GENERAL 


7.1.1 The term “Flight Recorders” encompasses several types of recorders that can be installed on aircraft for 
the purpose of complementing accident/incident investigation. (See Figure Ill-7-1.) ICAO requires crash survivable 
recorders for the purposes of accident investigation which incorporate the functions commonly associated with a Flight 
Data Recorder (FDR) and Cockpit Voice Recorder (CVR). However, many aircraft also have other recorders which are 
not crash survivable that are used routinely for daily airline operations. These recorders can be very useful to 
investigators and will often survive a crash even though they are not crash-protected. Combination recorders, recorders 
which record multiple functions in the same unit, are also becoming increasingly common. Crash survivable recorders 
are designed to withstand high impact forces, short and long duration fires, penetration and other environmental 
conditions in order to maximize the potential of surviving an accident. Generally speaking, fire is the most common 
cause for the recording medium not to survive. These different types of recorders, both survivable and non-survivable, 
are often referred to as ‘flight recorder’ in a general sense but specifically they are: 


a) Flight Data Recorder (FDR) is a crash-survivable system for recording data parameters from the 
aircraft's data systems. Parameters may be dedicated to the FDR but more commonly on newer 
aircraft, parameters are needed and used by the aircraft to operate and in these cases the data is 
readily available to be recorded by the FDR. Most States require that a minimum number of 
parameters be recorded that are considered mandatory but most current aircraft manufactured record 
vast numbers of parameters on the FDR that often exceed the mandatory minimum number required. 


b) Cockpit Voice Recorder (CVR) is a crash-survivable system for recording the internal acoustic 
environment of the flight deck and internal cockpit crew conversation along with inter-aircraft radio 
communications through a cockpit area microphone (CAM), boom microphones and Public Address 
system (P.A.) and radio-telephony communications. 


c) Airborne Image Recorder (AIR) is a crash-survivable system intended to capture and record cockpit 
images. Image recording, at the time of this writing, is not required by any States, however, several 
major accidents have highlighted the potential benefits of this capability in the future. The term ‘video’ 
recording was intentionally replaced with ‘image’ recording to reinforce that voice is a separate 
function and that the frame rate required for images for accident investigation is far less than the 
typical 30 frames/second of standard video. Five frames per second are considered adequate to 
capture motion and longer recording duration is favoured over higher frame rates for any image 
recording device. 


d) Data Link Recording is a crash-survivable recording which records digital messages transmitted 
between the aircraft and the ground. This method of communication replaces many of the traditional 
voice exchanges between an aircraft and air traffic control. Data link recordings are typically the same 
length of duration as the CVR. 


e) Combined Recorder, “combi”, refers to a crash-survivable unit which records more than one function 
in one box. Typically, a combi incorporates the FDR and CVR functions but can accommodate Image 
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Figure Ill-7-1. Flight recorder 


and Datalink recording capabilities, as applicable. For redundancy, most States will require at least 
two boxes installed on any large commercial aircraft if a combined recorder is used. One may be 
located forward and one may be located aft. 


f) Quick Access Recorder/Direct Access Recorder (QAR/DAR) is a non-crash survivable system for 
recording data parameters that typically contains data for a longer duration than the FDR with either a 
removable memory unit for convenience of obtaining the flight data or a wireless download option. 
QARs and DARS may record the identical data stream as the FDR or, in some cases, receive different 
data streams that may capture additional parameters. (Figure IIl-7-2.) 


7.1.2 It is desirable that the accident investigation authorities of each State maintain a list of the type and 
location of flight data and voice recorders in respect of each operator and aircraft type registered in that State. 


7.1.3 FDRs, QARs and DARs frequently record voluminous information that, combined with the CVR, in many 
cases can provide all of the necessary information to thoroughly investigate the accident. High priority must be given to 
their recovery from the wreckage and readout should take place as soon as possible. If the State conducting the 
investigation does not have adequate replay and analysis capability, then the recorders should be taken to an adequate 
facility in another State. Guidance on considerations for readout and analysis can be found in ICAO Annex 6, 
Attachment D. 


7.1.4 Specifications relating to the carriage of flight recorders on certain types of aeroplanes are contained in 
Annex 6 and several States require flight recorders to be fitted to public transport category aircraft as a matter of law 
whilst other States make administrative arrangements for their use. 
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Installation and protection 


7.1.5 Flight recorders intended to survive accidents are typically installed in the tail of the aircraft (either in the 
pressurized or non-pressurized area) where they are most likely to experience less physical damage in the crash 
environment. In the case of combined recorders (where two combined recorders are installed), it is recommended that 
the two recorders be separated by placing one in the tail and one in the nose of the aircraft. While the nose of the aircraft 
is a more hostile environment in terms of crash conditions, it also represents a shorter distance to the cockpit 
microphones, thereby improving the possibility of capturing the final milliseconds of acoustic information which can be 
critical to an investigation. 


7.1.6 The crash protective enclosure for flight recorders should be designed to meet accepted international 
standards that have been published for this purpose. Eurocae standards are an accepted international standard in terms 
of crash protection. 


7.1.7 Flight recorders should receive their electrical power from the bus bar that provides the maximum reliability 
for operation of the recorder without jeopardizing service to satisfy other essential or emergency loads. 


Location and retrieval of flight recorders 


7.1.8 After a catastrophic aircraft accident, the retrieval of the flight recorders may be a difficult task. Some 
guidance on what to look for may be necessary to aid in locating the recorders. The familiar appearance may be altered 
during an accident involving fire and impact, rendering the devices not immediately recognizable. While the recorders 
are tested to stringent survivability standards, they are not indestructible. The circumstances of an accident sometime 
exceed the design limitations and the recorder housing is compromised. In this case, the recorders may be more 
difficult to locate. For example, if there has been an intensive post-crash fire, the recorders may be blackened and no 
longer bright orange. Also, the crash-protected enclosure protecting the recording medium, normally the heaviest piece 
of the unit, may be jettisoned from the distinctive housing during a severe impact. For recovery purposes, it is important 
to obtain this module that houses the recorder memory, not the section of the recorder that does the signal processing. 
Figure Ill-7-3 is an example of recorder appearance following an accident. 


7.1.9 In some cases, the crash-protected enclosure may have been compromised, exposing the inside tape or 
solid state recording medium. Care should be taken to prevent further damage to these delicate components. All pieces 
of tape, electronic boards, or chips present in the vicinity of the recorder should be collected within reason. Exposed 
solid-state chips should be placed in an electrostatic bag if available. 


7.1.10 It is important to note the location of the flight recorders and to document the conditions to which they were 
subject at the accident site. For instance, if there was fire, the intensity and duration should be noted to better aid in 
determining the best procedure to recover the accident data. 


Underwater retrieval 


7.1.11 If the aircraft wreckage is located underwater and the location of the recorders is not apparent, special 
equipment may be necessary to identify and retrieve the devices. The FDR and CVR are equipped with an underwater 
locator beacon (ULB) commonly referred to as a “pinger’. Upon contact with moisture this device will activate and send 
out a sonar signal for approximately 30 days. This ULB must be maintained every 2-6 years (depending on the model), 
with the replacement of a battery in order to be effective. This device is not meant to operate after impact on land, only 
when submerged in water. Special equipment and often collaboration with maritime organizations is needed in order to 
pick up a locator signal and further recover the units depending on the circumstances. Several investigative laboratories 
have previous experience in this procedure that States may draw upon for assistance. 
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Figure Ill-7-2. Aircraft data flow 





Figure Ill-7-3. Damaged recording media 
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7.1.12 If the FDR and CVR are underwater, it is necessary to retrieve and transport them in the proper manner to 
mitigate further damage. Two watertight containers, such as ordinary coolers, which are slightly larger than the recorders 
should be brought to the retrieval site. Once the recorders are located, they should be rinsed in fresh (distilled or de- 
ionized) water and placed in the watertight container. They should be transported fully submerged in fresh water (or 
water from the site if clean water is not available). Both recorders should be kept in water at all times as oxidation will 
occur rapidly which can lead to damaging the recorder data. 


7.1.13 The top of the containers may be sealed with silicone during transport, which minimizes exposure to air. 
Immediate transfer to a qualified laboratory facility is vital. Experienced laboratories will normally disassemble the 
recorder in water so as to minimize exposure to the air until it is time for the playback. 


Recorder readout preparation 


7.1.14 Irrespective of the type of recording system, no attempt should be made to conduct a readout at the 
accident site: either in the aircraft or on playback units. Even if the recorder appears to be in good condition, there could 
be internal damage due to heat or impact. Critical safety data has been lost as a result of attempted premature playback. 
Some of the risks include the tape recording medium being broken, stretched, melted, or intertwined with debris. A flight 
recorder’s circuitry could be shorted out, internal memory boards cracked, or memory chips melted. Playing back FDRs 
or CVRs without proper precaution could destroy the data permanently. 


7.1.15 The flight recorders should be hand-carried to an adequate playback and analysis facility where suitable 
processing by qualified personnel can take place. When shipping or transporting the flight recorders, they should be 
packaged adequately to avoid further damage. No attempt should be made to clean the recorder at the scene, with the 
exception of rinsing with fresh water if the recorder is already wet. If possible, avoid exposure to x-ray and other radio 
waves, for example, from automatic doors. 


7.1.16 If the State conducting the investigation does not have adequate replay and/or analysis capability, then the 
recorders should be taken to an adequate facility of another State in a timely manner. Guidance on considerations for 
readout and analysis can be found in ICAO Annex 13, Attachment D. There are several laboratory playback facilities 
throughout the world and generally they are willing to assist States with flight recorder services without cost. Whenever 
possible, all flight recorders from an event should be taken to the same facility. The information on the units is often 
complimentary and cross-correlation and validation of data is simplified. Additionally, the FDR and CVR information can 
be readily combined into a comprehensive flight reconstruction with integrated audio and voice transcript. 


7.1.17 Before taking a recorder to an investigative agency to perform a readout, it would be beneficial to send as 
much information ahead as possible regarding the recorder such as the faceplate information (manufacturer, part 
number and serial number), modification history, description of overall condition and digital photos of the unit. 
Additionally, details about the event such as aircraft type and serial number, event location and description will aid in 
readout preparation. 


7.2 FLIGHT DATA RECORDERS 


7.2.4 Flight data, voice, images, and data link messages can be recorded on three distinct types of recording 
media: tape, optical disk or solid state memory chips. All current FDRs in service record digital data but this digital data 
may be recorded on tape media or solid state media. Optical disks are only used for QARs and DARs as they cannot be 
effectively crash protected. Most QARs and DARs today are solid state, like their FDR counterparts. Analogue recorders 
(such as the old metal foil) are no longer in service. Tape recorders are also no longer manufactured in favour of the 
easier to maintain and more reliable solid state memory. 
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7.2.2 It should be noted that this chapter primarily relates to the primary purpose of the FDR — namely accident 
investigation; although more and more airlines are using the FDR or a comparable QAR for routine monitoring and 
accident prevention. 


Purpose of the flight data recorder 


7.2.3 The primary purpose of a modern FDR system is to capture all significant data related to the operation and 
performance of the aircraft from the voluminous data available on the aircraft's data bus systems. Often there is 
sufficient information to derive the flight path of the aircraft in three dimensions, to determine the attitude of the aircraft, 
to determine the forces acting on the aircraft and to determine the precise manner in which the aircraft was being 
operated. Often the FDR will also record the status of numerous systems as well as any warnings that may have 
triggered. QARs and DARs essentially record the same or more information as the FDR but are more readily accessible 
for routine use and/or the investigation of incidents. It should be noted that optical QARs should not be used for incident 
investigation alone (the FDR should always be secured) since optical disks frequently have data losses due to the 
inability to record during turbulence or violent motion. 


Recording media 


7.2.4 There are four basic types of flight recording media in use at the present time, namely the optical disk 
(older QARs and DARs), PCMCIA cards (QARS and DARs), tape (older recorders) and solid state. 


Removal and handling of recorded mediums 


7.2.5 The following precautions must be observed in removal and subsequent handling of recording mediums. 
Irrespective of the type of recording system, no attempt should be made to conduct a readout at the accident site; 
instead the recorder should be hand-carried in a timely manner to an adequate playback and analysis facility where 
suitable processing by qualified personnel can take place. Whenever possible, all recorders should be taken to the same 
facility as the information is often complimentary; this is helpful for cross-correlation and validation and the information 
can be combined into a comprehensive flight reconstruction with integrated audio and voice transcript. 


Readout and analysis 


7.2.6 There are two clearly defined processes for FDRs and CVRs as well as other recordings used by the 
investigation. The first process is the extraction of the recorded data from the medium in its unprocessed state. The 
second is the conversion to meaningful information such as engineering units for the case of flight data and usable audio 
in the case of a CVR. 


Data extraction process 


7.2.7 The data extraction process is to obtain a readout of the media contents of the recorder. For tape-based 
recorders, experienced investigation labs have techniques which digitize the tape signal and specialized software is 
used to decode the information. For solid state memory media, the proper interface protocol software is used to 
communicate with the memory device. Airline playback facilities, primarily designed for maintenance of the recorder, 
should not be used for an investigation. Investigation authorities use specially developed software capable of 
investigating the data at the bit level and have special techniques for recovering information from damaged media. 
(Figure III-7-4.) 
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Figure Ill-7-4. Bit level editing — Correcting for “drop-outs” 


Conversion to engineering units 


7.2.8 Once the data has been successfully extracted from the recorder, the analysis process can begin. 
Converting all of the recorded flight data into engineering units is no longer practical due to the voluminous data 
recorded. Today, there are sophisticated software tools that interactively convert binary data into engineering units on an 
as-needed basis to facilitate the analysis process. It is important for investigators to appreciate this aspect and work 
closely with the specialists that are versed in these software tools. Proper analysis tools, including flight animation tools, 
should be able to interactively work with the binary data and convert the data as needed for the application. This 
eliminates unnecessary and inefficient preprocessing of the data. If the aircraft manufacturer needs the data to assist 
with the investigation, they will normally want the raw binary data, not preprocessed data that is already in engineering 
units. 


7.2.9 In dealing with FDR recorded data it will only be possible to obtain a readout of the raw data from those 
organizations which have the appropriate readout equipment. This may necessitate allowing the flight recording to be 
taken outside the jurisdiction of the State conducting the investigation. It should be the responsibility of the accredited 
representative of the State in which the readout is conducted to ensure that the appropriate level of priority and security 
is attached to obtain an accurate and timely readout. 


Selection of parameters 


7.2.10 On today’s modern digital aircraft with data rich environments, aircraft manufacturers record data well 
beyond the mandatory requirements, striving to capture virtually all relevant information on the data busses. The latest 
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generation of aircraft may have thousands of parameters recorded. It is important for investigators to have proper 
analysis tools to validate the conversion of the raw data into engineering units and to efficiently search and sift through 
the data to extract the relevant parameters to the investigation at hand. A professional analysis system capable of 
interactively working with the flight data is recommended over paper printouts or spreadsheets of the data. Printouts and 
spreadsheets were acceptable only with limited numbers of parameters, but with the huge amount of parameters 
available today, investigators need proper tools to facilitate the study of the data. 


7.2.11 Data format is an important consideration when using/sharing flight data among stakeholders during an 
accident investigation. The use of spreadsheets (such as Microsoft Excel) to disseminate flight data has become 
increasingly popular, however most investigation authorities and aircraft manufacturers strongly prefer the data in its 
original format. When passing spreadsheet files from one process or system to another, it becomes problematic to pass 
all of the recorded parameters. A modern aircraft may have well over a thousand parameters and applications such as 
Microsoft Excel cannot handle the data due to file size limitations. What is typically done is to send only the parameters 
needed. This can compromise the process because the investigator does not have all of the information and must pre- 
judge what is important. 


7.2.12 Another more serious problem with using spreadsheet files for analysis is the time element. Two 
parameters that are both recorded at one sample per second are actually not sampled at the same time within the 
second. There is a relative offset, often based on the word location. For example aileron position and control wheel, 
while both sampled once per second, will be offset from each other by as much as just under a second. In order to 
maintain the timing resolution of the original data, the Engineering Unit file must be incremented at intervals coincident 
with the data frame rate. For example, a 64 word/sec rate would require the data printed out in 1/64 time intervals to 
maintain the same time resolution for each parameter. This means that if you want to look at 25 hours of data using 
Engineering Unit files, you would need 64 lines of data for each second. 


7.2.13 Aircraft manufacturers are also becoming aware of this growing problem of using spreadsheets to analyze 
and disseminate flight data. If a spreadsheet is sent to someone for analysis assistance (such as the aircraft 
manufacturer) the recipient does not get all the parameters, does not get the proper time resolution, and does not have 
the ability to check the engineering units conversion process if they suspect a problem. The conversion process to 
engineering units has many opportunities for error, especially with parameters infrequently analyzed. One should never 
accept the engineering units’ data as factual without proper validation each time. 


Analysis 


7.2.14 The analysis process is usually carried out by a multi-disciplined team that includes experienced flight data 
analysts in consultation with performance engineers, aeronautical engineers, operations specialists and systems 
specialists. During the analysis of recorded flight data and/or voice, graphical plots, transcripts and flight animations are 
all effective techniques to begin to document the relevant aspects of the recordings that begin to tell a story. Deriving 
additional parameters mathematically, interpolation, extrapolation and other techniques are used to understand the data. 
(Figure III-7-5.) 


7.2.15 Aircraft performance. A fundamental part of the flight data recorder process is to verify whether or not the 
aircraft is performing as per the data or is the data incorrect. In the past, expensive flight simulators could be used for 
this verification, however with today’s modern computer, it is now practical to perform certain performance validation 
tasks on a personal computer with suitable software and expertise. The aircraft manufacturer also has engineering 
simulators which can be used to validate the flight data and for complex cases the manufacturer should be intimately 
involved in this process due to the high degree of aerodynamic parameters required and the high level of expertise 
required. A full motion simulator is useful when motion and/or ergonomic issues are such that the replicated flight deck 
and motion sensations are potential factors in the investigation. 
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7.3. COCKPIT VOICE RECORDERS 


General 


7.3.1 The need to install cockpit voice recorders on transport aircraft results from the fact that in many accidents 
and serious incidents, the actions or lack of actions of the flight crew are a significant component to understanding the 
investigation. In addition to valuable inter-crew communications, the acoustic environment of the flight deck can shed 
important light on many investigations. 


Purpose of the cockpit voice recorder 


7.3.2 The primary purpose of the cockpit voice recorder is to provide the accident investigation with a record of 
the communications on the flight deck, the radio communications with the ground controllers as well as a record of the 
general acoustic environment onboard the aircraft. 


7.3.3 Experience has shown that significant sounds are often recorded, e.g. switches being actuated, flap and 
landing gear selectors being operated, aural warning signals, engine noise, cockpit noise associated with changes in 
airspeed, etc. This type of information is of considerable assistance to the investigation, especially when the precise time 
of each sound can be determined from the recording. 





~ 


Figure Ill-7-5. .FDR/CVR Lab (Courtesy of Transportation Safety Board of Canada) 
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Selection of parameters 
7.3.4 Cockpit voice recorders should normally record the following: 
a) voice and/or digital communications transmitted from or received in the aeroplane by radio; 
b) voice communications of flight crew members on the flight deck; 
c) voice communications of flight crew members on the flight deck using the aircraft’s interphone system; 


d) voice or audio signals identifying navigation or approach aids introduced into a headset or speaker; 
and 


e) voice communications of flight crew members using the passenger loud speaker system, when there 
is such a system and the fourth recording channel is not in use. 


7.3.5 To record effectively the voices of flight crew members on the flight deck, a cockpit-mounted area 
microphone is installed in the best position to record voice communications originating at the first and second pilot 
stations as well as voice communications of other crew members on the flight deck when directed to those stations. 
Care must be taken in locating the microphone and adjusting or supplementing the preamplifiers and filters of the 
recorder to assure a high level of intelligibility of the recorded communications when recorded under cockpit noise 
conditions in flight. 


7.3.6 Cockpit voice recorders should be installed so that each source of information described above can be 
recorded on a separate channel. This could be achieved as follows: 


a) for the first channel, from each microphone, headset or speaker used at the first pilot position; 

b) for the second channel, from each microphone, headset or speaker used at the second pilot station; 

c) for the third channel, from the cockpit-mounted area microphone; 

d) for the fourth channel, from each microphone, headset, or speaker used at the station for the third or 


fourth crew members or, when not in use for this purpose, from microphones associated with the 
aeroplane’s loud speaker system. 


Installation and protection 


7.3.7 Installation of a cockpit voice recorder should be made so that the probability of inadvertent actuation and 
operation of the bulk erasure device during crash impact is minimized. 


Readout and analysis 


7.3.8 There are two processes in the readout and analysis of CVRs These are the data extraction process 
(same as for FDRs), and the transcription/analysis process. 


7.3.9 The purpose of the data extraction stage is to obtain a recording for the purposes of transcription and 
sound analysis. In order to accomplish this, it is necessary to employ specialized tape playback equipment designed to 
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reproduce the tape from a specific type of cockpit voice recorder. Experienced labs have adjustable tape decks for this 
purpose. For solid state CVRs, the memory is extracted similarly to a solid state FDR, using the proper interface 
protocols to communicate with the memory device. 


7.3.10 For tape recorders, it is necessary to time correct the recording since it cannot be played back at precisely 
the same speed as it was recorded. Small speed errors will result in large timing errors over time. There are several 
techniques known by experienced investigation labs, such as using the 400 Hz aircraft frequency to time adjust and, a 
better solution, correlating the VHF keying with the recorded flight data using a linear regression over the full duration of 
the CVR. 


7.3.11 For solid state CVRs, timing can also be an issue. Some modern systems record GPS time on all 
recorders, making synchronization relatively easy. 


7.3.12 For CVRs regardless of tape or solid state, a digital industry lossless compression standard such as (wave 
or .wav file) is normally generated at a sampling rate of 22 kHz or higher. Experienced investigation labs have 
techniques to slow down speech while maintaining proper pitch, perform noise filtering and perform spectral analysis to 
identify sounds and engine behaviour. All of these applications can be employed to greatly enhance the quality of aCVR 
transcript. 


7.3.13 A CVR transcript is usually conducted by a group of multi-discipline specialists including acoustic analysis 
specialists, operations specialists and systems specialists. The purpose of the group is to produce an accurate transcript 
of relevant conversation. States should apply considerable privilege and protection to CVRs. The group should only 
transcribe relevant information as there is usually no need to transcribe personal information that does not contribute to 
the investigation. If personal conversation is consuming an inappropriate amount of time during the flight, an editorial 
observation may be used to note that a personal conversation occurred during a specific time period. Sometimes it may 
be necessary to transcribe personal conversations. Care must be exercised when transcribing the actual words of a 
personal conversation. The need for using the actual words must be balanced against the privacy issues of the crew and 
the needs of the investigation process. It is also an accepted practice to substitute symbols (#) for expletives. Other 
useful symbols for transcripts include () to denote where specific words have been translated from a specific language. 


7.3.14 States shall not release the audio cockpit voice recording or a transcript of the recording to the public. 
Recordings and transcripts should be adequately protected to prevent inadvertent release. It may however, be essential 
to the analysis and understanding of the occurrence to include relevant parts of the transcript from the CVR in the final 
report or its appendices. When doing so, care must taken to ensure that in the final report a description of what was said 
is included rather than a quote of the actual words of a personal conversation. Parts of the transcript not essential to the 
analysis shall not be disclosed. Chapter 5 of Annex 13 contains provisions pertinent to transcribed voice recordings and 
should be taken into account when it is considered necessary to include relevant parts of a transcript in the final report or 
its appendices. 


Operational/human factors analysis 


7.3.15 The primary purpose of the cockpit voice recorder is to record the flight crews communication. 
Experienced accident investigators with specific training in the necessary fields typically accomplish the analysis of the 
cockpit voice recorder for the human factor and operations portions of an investigation. The analysis of the cockpit voice 
recorder content typically includes a review of operating procedures, crew interaction and crew performance. The 
analysis can be broad to encompass generalized events or it can be very specific to analyse the speech patterns of a 
crew member or the pronunciations of specific syllables. The analysis can also provide valuable insight into crew 
physical actions through evaluation of grunts or straining during speech. Use of CVR analysis in conjunction with 
findings from other areas of the investigation can facilitate the identification of crew actions, crew state, and any other 
potential factors affecting human performance (such as impairment due to medical conditions). 
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Acoustic analysis 


7.3.16 The cockpit voice recorder’s primary purpose is to record voice communications. Most cockpit voice 
recorder systems are designed for voice and have a bandwidth and/or filters that optimize the recording of the human 
voice. The cockpit voice recorder is not an acoustic recorder — that is, although the cockpit voice recorder records all 
audio that is received by the microphones, the microphones may not pick up all of the audio in the aircraft. Additionally, 
because each aircraft and its cockpit may be subject to different environmental conditions, the fidelity of the 
microphones may be vastly different between aircraft. Integrity of the installation and age of the cockpit voice recorder 
system is also a factor in the quality of the recording. 


7.3.17 With these limitations, however, it is still possible to obtain acoustic information useful in analyzing several 
aspects of the aircraft, including engine speed, propeller rotational speed, rotor speed, transmission operation, hydraulic 
pump operation, and ground speed. This information may be recorded on the cockpit area microphone channel. While it 
is possible to analyze the sounds and make accurate calculations, it is not usually possible to determine precise location 
of an acoustic source using the cockpit area microphone recording, because it is a single source recording. It is also not 
possible to determine, for instance, which engine failed in an engine failure — the recording would simply show a signal 
reducing in frequency, but it is not possible to determine from the recording if it is the left, right or center engine. 


7.3.18 Acoustic analysis using a cockpit voice recording from an accident should be done with caution. While the 
analysis can typically provide direction in an investigation, the interpretation of the acoustics can vary and should be 
confirmed through physical evidence or other data sources. 


7.4 FLIGHT ANIMATION 


7.4.1 Flight animation has grown significantly in popularity, especially with the advent of flight data analysis 
programmes whereby airlines routinely monitor their flight data for improved efficiency and safety. There are numerous 
flight animation systems available today and investigators must be very cautious when using flight animations as they 
may not be able to portray a complex accident/incident event accurately and perhaps lead to misinterpretation. Airline 
animations are typically automatic systems that can generate an animation in minutes. They are used to rapidly replay 
relatively benign in-service events, primarily for flight crews. (Figure IIl-7-6.) 


7.4.2 The benefits of animating data include assimilating complex information and facilitating analysis. In some 
instances, when investigating complex scenarios, flight animation can lend credibility to findings and subsequent 
recommendations. The pitfalls of flight animation include pretty picture syndrome (seeing is believing), fabrication, 
subjective information, and drawing conclusions without understanding underlying principles. The current limitations of 
sample rates, resolution, aircraft architecture (where the parameters are obtained), interpolation issues, and difficult to 
measure factors such as weather, all affect the objectivity and quality of a flight animation. 


7.4.3 In an accident investigation, where a flight crew reputation is often on the line and the stakes are often high, 
the use of any automated tool represents a considerable risk. It is extremely important that the investigation team be 
fully aware of every step of the animation process so that any conclusions drawn are well supported. The caveat ‘Any 
conclusions based on this animation should be thoroughly reviewed in light of the manner in which it was produced’ or 
similar caveat should be considered by the investigation agency. Due to the subjectivity of flight animations and the fact 
that they are powerful and compelling, investigation authorities need to take great care in ensuring that the animation is 
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Figure Ill-7-6. Typical flight animation 


an accurate representation of what really happened. With the popularity of animation in airline flight data analysis 
programmes, investigators should resist the temptation to use a tool designed for “normal" routine flight sequences on 
accident data that typically contains abnormal out of the “envelope” flight scenarios. It is also recommended that any 
flight animation not be shown too widely until such time that the experts responsible for developing it are satisfied that it 
is accurate and any assumptions used to generate it are well understood and documented. Most of the major flight 
recorder labs around the world have significant expertise and experience in flight animation. The expertise generally 
required is a strong aircraft performance or professional engineering background combined with operational flying 
experience. 


7.5 OTHER RECORDING DEVICES 


Flight data collection devices 


7.5.1 Many aircraft have devices on board, other than FDRs and CVRs, that are used routinely for daily airline 
operations. While these are not crash-protected, they may contain valuable information to help with an accident 
investigation. Advancements in aircraft technology have made it possible for aircraft and component manufacturers and 
operators to collect and use data routinely to track maintenance procedures, make problem diagnoses, establish data 
trends and identify safety concerns. Airlines using data on a routine basis have been able to improve operational 
efficiency, thus lowering costs. 
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7.5.2 These data collection and review programs such as Flight Operational Quality Assurance (FOQA) or Flight 
Data Analysis Program (FDAP) for aircraft or Health and Usage Monitoring Systems (HUMS) for rotorcraft are not 
mandatory in many States but are highly encouraged. Frequent review of flight data is beneficial since it provides an 
informal check of aircraft systems which may contribute to the flight recording system integrity and highlight any 
abnormalities that may lead to future problems. While the mandatory FDR unit may be used as the recording device, the 
flight data is most commonly collected by an additional Quick Access Recorder (QAR) or Digital Access Recorder (DAR) 
which is not crash-protected. QARs and DARs may record an identical set or, sometimes, more or less information than 
the mandatory FDR. These devices are typically located near the cockpit which makes them more accessible for daily 
retrieval. Older QAR or DAR units may utilize optical disks or tape as a storage medium. Most QARs and DARs 
produced today are solid state, like their FDR counterparts or employ a memory card (PC card or PCMCIA) to hold data. 
The latest technology allows wireless transfer of data straight from the aircraft to a ground station without any human 
interaction. Air carriers utilize automated software to sift through hundreds of hours of flight data to identify 
predetermined exceedences. 


7.5.3 It should be noted that optional data collection devices such as QARs and DARs should not be used for 
incident investigation alone (the FDR and CVR should always be secured). These devices are not crash-protected nor 
are they designed to withstand the same survivability or operational requirements as mandatory recorders, so they are 
not as reliable. For instance, optical disks frequently have data losses due to the inability to record during turbulence or 
violent motion. While proactive use of data is a noble effort and contributes considerably to preventive safety measures, 
it is not a replacement during an accident investigation. Although data from QARs and DARs can enhance the process, 
it should always be obtained in the rawest format available since there is no certification of the software tools that are 
used and the data output may be smoothed or predicted. These additional data collection devices are one more tool that 
can be used to assist in an investigation. 


Other flight data sources 


7.5.4 Many of the instruments and avionics in modern digital aircraft contain non-volatile memory (NVM), which 
can provide critical information not captured anywhere else. These devices are particularly useful when no FDR or CVR 
is present on an aircraft. Many States do not require cargo transports, corporate or business jets, helicopters, military or 
general aviation to be equipped with an FDR or CVR. In this case, NVM is the sole source of information. Though these 
units are not crash-protected, it is often possible to recover useful data even in the event of a catastrophic accident. 


7.5.5 An aircraft manufacturer should have information relating to any sources of non-volatile memory that may 
be present on the aircraft in a particular system. Some systems that commonly employ NVM are the Flight Management 
Computer (FMC), Full Authority Digital Engine Control (FADEC), EEC, Radio Stacks, Fuel Gauges, Global Positioning 
System (GPS), Engine Instrument Crew Alert System (EICAS), Power Analyzer Recorder (PAR) or Enhanced Ground 
Proximity Warning System (EGPWS). 


7.5.6 Some FADECs can record up to four hours of flight, diagnose problem areas, provide a review of recent 
history of an engine's vital functions such as pressures, throttle position, temperatures, fuel flow, RPM and ignition 
system timing. Stored maintenance information may even include pressure-altitude, airspeed, engine setting, and engine 
fault codes. EGPWS systems record a wealth of parametric data over the period from 10 seconds before to 20 seconds 
after any event that triggers an EGPWS warning. This data includes: 

a) AGLaltitude as calculated and corrected based on all sources; 

b) altitude rate; 


c) aircraft pitch and roll angles; 


d) body angle of attack (AOA); 
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e) longitudinal acceleration; 

f) normal acceleration; 

g) inertial (earth axis) acceleration; 

h) glideslope deviation; 

i) temperature in °C; 

j) range settings for navigation display 1, 2; 
k) aircraft airborne flag; and 

1) approach-mode flag. 


7.5.7 Certain panel mount devices, such as multi-engine monitors, are capable of storing and downloading 
engine-related information including: 


a) RPM; 

b) cylinder head temperature; 
c) exhaust gas temperature; 
d) oil temperature; 

e) manifold pressure; 

f) fuel flow; 

g) total fuel used; and 

h) battery voltage. 


7.5.8 The use of GPS navigational units is becoming increasingly common on even single-engine, piston-driven, 
general aviation aircraft. Older devices (pre-1990) usually employed volatile static random access memory (SRAM). 
Newer devices generally employ NVM and, depending on the make and model, these devices may hold a history of the 
aircraft's flight plan, position, altitude, track, radio frequencies, and transponder codes. In general, as a matter of design, 
handheld and portable units will be found to contain more historical data than a typical panel mount unit. Non-powered 
aircraft, such as gliders, will generally contain a special purpose-built data logging device fitted to record parameter-data 
for post flight training and use in scoring contest and international record attempts. Some of these dataloggers employ 
mechanical means to erase any data in the event that the unit is disassembled and encode the stored information in a 
protected proprietary format — a precaution used to discourage data tampering. 


7.5.9 NVM memory devices will fall into several classes, depending on the original purpose of the device and its 
design history. Some devices, like handheld GPS units and dataloggers, are designed with interfaces permitting the 
download and presentation of any recorded information to a PC running the appropriate commercially available software. 
These devices, if undamaged, require little expertise to download, the software tools are readily available, and the data 
can be presented in an easy-to-understand format. Other devices, like certain multi-function displays, employ flash 
memory cards like those used in digital cameras to permit the download of recorded data. These devices may require 
somewhat more expertise to download and analyze, but the resources should be readily available. Many other devices, 
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like certain primary flight displays and EGPWS systems, contain internal interfaces available for downloading data under 
special circumstances, such as factory troubleshooting or maintenance. These devices will generally require 
manufacturer support, at lease initially, as the tools used to download and analyze the data will generally be in-house 
lab-grade software and hardware, and the recovered data will require a fair amount of design expertise to interpret. 
Finally, many devices, like certain engine displays, altitude heading reference units, flap control units, etc., may contain 
varying amounts of information related to exceedances or internal errors. This information may be retained on NVM 
within the unit, but will require extensive expertise to recover and interpret the data, as no interface exists for routine 
downloading of the data. 


7.5.10 An aircraft manufacturer should have information relating to other sources of non-volatile memory that may 
be present on the aircraft in particular systems. Due to the varied nature of the instrumentation, a major investigative lab 
should be contacted to determine how to handle a unit. In a component employing SRAM such as an earlier model 
portable GPS, a battery backup may be used to preserve data when power is not present on the unit. Depletion of the 
battery due to mechanical damage or water corrosion will destroy this data, thus preventing recovery. Time is of the 
essence when dealing with these units. Battery power should be preserved for any unit employing volatile memory. If the 
unit has been subject to water exposure, especially salt-water, it is imperative that the unit be flushed with clean pure 
deionized water as soon as possible and rapidly dried, ideally under a weak vacuum. If this is not possible, the unit 
should be transported submerged in clean pure deionized water to a lab capable of handling such devices. Battery 
power should, in general, be removed from units containg NVM, as this power is not needed for data preservation, but 
might contribute to data loss if corrosion occurs or the unit is powered up and begins to over-write old data. All units, 
even units employing NVM, will contain internal backup batteries designed to preserve volatile memory for the system 
clock and other operating system data. Moisture containing any salts or other mineral impurities will immediately 
promote corrosion which can quickly — within a matter of hours — eat through circuit traces and other metal parts, 
ultimately removing backup power from any volatile memory devices and possibly damaging an NVM unit beyond 
normal recovery. Since most water contains trace salts and some amount of dissolved free oxygen, this process can and 
will occur (albeit at a slower rate) even if the unit remains totally immersed. This corrosion process is greatly accelerated 
if the unit is kept in a warm place. De-ionized water contains little to no dissolved oxygen, and if kept cool this 
environment is far preferable to storage in natural water. 


7.5.11 Since most of these units are not crash-protected, NVM units that are mechanically or corrosion damaged 
will normally not be recoverable using normal means. Often, however, due to their small size and low mass, the flash 
memory devices within these units will survive, although extensive manufacturer expertise would be required to 
reconstruct the data stored directly on these devices. Indeed, given the manufacturing methods and design tools used to 
construct modern electronics, this expertise may no longer exist even with the manufacturer. The most promising 
recovery method involves recovering the flash memory device or devices containing the parametric data of interest, and 
installing these devices into a known good unit of like make and model. Manufacturer expertise may be required to help 
determine which chip or chips contain the recorded data and/or other operating system code required to successfully 
recover the information using a surrogate unit. 


Visual recordings 


7.5.12 An increasing contributor to investigations are digital camera or video data. In some cases, passengers on 
board or witnesses on the ground have digital or video cameras or an aircraft may be equipped with a recording device 
to capture scenic flights. Security cameras on the airport may show information on loading, or on bridges, tolls or 
buildings in the vicinity of the accident or on the airport. Many of these devices record their data in compressed or 
proprietary formats which makes recovery more challenging. (Figure Ill-7-7.) 
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Figure Ill-7-7._ Picture taken by a witness to a DC-10 in an unrecoverable bank 
just moments before a crash 


7.5.13 Increasingly, videos and recorded images are providing valuable information for investigators. Devices that 
record image data include, but are not limited to: image recorders, camcorders, video recorders/cameras, digital 
cameras, digital video recorders, and flight-test equipment. These could come from witness videos, tour operator videos, 
news agency footage, or surveillance cameras. In addition to images of the accident or incident, images from a prior 
time period may also be of investigative value. 


7.5.14 When using images or video during an investigation, it is important to make every effort to obtain the 
original recorded media. During playback the original image may be down-sampled to make it easier or smaller to export. 
This down-sampling could remove valuable information that may be contained in the original image. Generally it is 
always best to obtain a digital copy of the original stored media. If it is not possible to copy the original, then the entire 
machine or storage device should be retained so a digital copy can be made at a later date. 
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7.5.15 Also important is getting technical specifications about the recording device or system, the camera(s), and 
information about the recording system setup and configuration. Every effort should also be made to determine the 
camera location as accurately as possible. For fixed cameras, such as security systems, providing an engineering 
drawing depicting the camera location relative to surrounding landmarks, such as buildings, roads, taxiways and 
runways, etc. (particularly any landmarks that are in the camera’s view) is ideal. These drawings are often available from 
the airport authority or a city/county planning office. For video from a hand-held camera, it is important to have the 
location of the camera operator at the time the recording was made. If possible, the location should be provided on a 
map, or by GPS location. Additionally information about several of the predominant features that are visible in the scene 
are needed to calibrate the recorded accident image. 


7.5.16 To read out and analyze video and image data, specific hardware and software is needed. Additionally, 
personnel must have specialized training in interpreting the recorded images. As this is an emerging field in 
investigations, many experienced laboratories may be able to provide guidance or assistance in the readout and 
analysis of video and image data. 


Radar data and ATC transcript 


7.5.17 Analogue and digital recorders are utilized by most States for ground air traffic control services (ATS) 
centres and units. Recordings may cover not only air-ground voice and data link communications, but also voice, radio, 
satellite and land line communications between the various ground services or stations (aircraft movement and control 
coordination exchanges, exchanges between ATS and meteorological officers, fire-fighting vehicles, etc.). Information on 
Radar Data and ATC recorders is covered in detail in Chapter 5. 


7.5.18 During an accident investigation, it may be necessary to collect datalinked information that was transmitted 
from the Aircraft Communications Addressing and Reporting System (ACARS) or Aircraft Condition Monitoring System 
(ACMS). It is possible that an operator may also record communication between the aircraft and ground personnel that 
covers a period not contained on the CVR. 


7.6 FUTURE REQUIREMENTS 


New design 


7.6.1 While not yet required in most States, manufacturers and operators are employing dual redundant 
combination recorders, and two-hour long CVRs to replace the old thirty-minute versions. Also, independent power 
supplies for CVRs, to enable them to continue operations for ten minutes after power to the recorder has ceased, have 
been proposed. 


Datalink recordings 


7.6.2 In the past, exchanges between ATC and the crew were normally preserved on the CVR. With the advent 
of Communication Navigation Surveillance/Air Traffic Management, this will no longer be the case. In the future it might 
be mandated for CNS/ATM information to be recorded. Some CVRs are equipped today to meet this requirement. These 
will be recorded for the same length of time as CVRs, usually for two hours. 
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Airborne image recording 


7.6.3 Accident investigators have also recommended the implementation of Airborne Image Recorders (AIR). 
EUROCAE has already developed a technical standard and the technology is available to employ them. While traditional 
FDRs and CVRs are invaluable, additional information could be gained from an inside view of the cockpit. The benefits 
of AIR include a documentation of human-machine interaction (switches, throttles, controls), the ambient cockpit 
environment (smoke, lighting), non-verbal communications (hand signals) and crew interaction. It has the potential to 
capture hundreds of additional parameters not currently recorded. Additionally, on aircraft that are not equipped with 
either a traditional FDR or CVR, an airborne image recorder might be a low cost means of equipping the aircraft with an 
FDR or a CVR. An airborne image recorder would provide parametric data from the cockpit instruments. (See 
Figure III-7-8.) 





Figure Ill-7-8. Image from an Airborne Image Recorder 
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7.7 CONCLUSION 


7.7.1 The mandatory crash-protected FDR and CVR are integral parts of an accident investigation. In order for 
them to be most beneficial they must be adequately maintained and documented. Following an event, the recorders 
must be located quickly and transported immediately to an appropriate facility for, analysis. Their contents need to be 
analyzed by qualified experts jointly with all other data concerning the event including the on-scene portion and 
participant contributions, in order to have the maximum benefit. To have the most impact, the data must be handled in a 
timely and efficient manner. 


7.7.2 There are many valuable sources of data that can help during an investigation. Especially in modern, 
electronic aircraft the data gathered can provide vital clues as to faults, maintenance, operations of systems and actions 
on board. 


7.7.3 Effective data collection programmes are a significant step towards incident and accident prevention. The 
benefits of proactive data use in terms of both safety and cost guarantee its development in the future. In addition, 
technological advancements will continually change the aircraft and cockpit environment and create a greater reliance 
on data during an investigation. Information previously obtained through interviews is now stored on disk drives, 
computer cards, and portable units. Investigation and data gathering techniques must constantly be improved to keep 
abreast of technology. 


Chapter 8 


RECONSTRUCTION OF WRECKAGE 


8.1. GENERAL 


8.1.1 The decision for wreckage reconstruction will be based upon many factors, and will also impact the 
methods and precautions employed during wreckage identification and recovery. Anomalies in the flight trajectory or 
wreckage distribution may indicate the need for close analysis of portions or the entire accident aircraft. Techniques and 
methods utilized for the wreckage recovery, discussed in Part | of this manual and in the Airport Services Manual 
(Doc 9137), Part 5, Removal of Disabled Aircraft, provide further guidance. 


8.1.2 Wreckage reconstruction can be a very useful tool for certain accident investigations. “Reconstruction” is 
the assembly of the various pieces of aircraft wreckage in their relative position before failure. A reconstruction is by no 
means necessary for every accident. But it can be the key for determining the existence of clues leading to the causes of 
the event. It can eliminate certain causes as well. 


8.1.3 Wreckage reconstruction can consist of a simple laying out of all or certain portions of the wreckage in the 
general configuration of the aircraft, to a detailed three-dimensional reconstruction of major portions of the aircraft. With 
the advent of software and computer-aided design tools, computer or “virtual” reconstructions can also be performed. 


8.1.4 The reconstruction procedure is a twofold proposition. First, the various pieces must be identified and 
arranged in their relative positions. Second, a detailed examination is made of the damage to each piece and the 
relationship of this damage to the damage on other adjacent or associated pieces is established. This latter work is the 
chief purpose behind the reconstruction. See Figures III-8-1 to IIl-8-5 for examples of reconstruction of wreckage. 


8.1.5 A reconstruction may be accomplished by one or more investigation groups, typically the structures or 
systems group. Larger reconstruction efforts might require the formation of a separate reconstruction group. Of course, 


the circumstances of the accident and the available resources (time, money and personnel) will be major factors in the 
extent of the reconstruction. 


8.2 WHEN TO PERFORM A RECONSTRUCTION 
8.2.1 A first question the investigator must ask is when is a wreckage reconstruction valuable to perform. In 
general, reconstructions are especially useful for events involving in-flight structural breakup, collisions, fires or 
explosions. It helps in understanding such things as: breakup patterns, sequence, loss of parts, etc.; the spread and 
effects of fire, smoke and heat; mid-air collisions or collisions with missiles or other projectiles, meteor hits, space debris, 
etc; and chemical residue or overpressure from explosions or explosives devices. 
8.2.2 Factors that may support the desirability of a reconstruction include: 


a) evidence of in-flight fire and smoke on the structures and systems; 


b) parts found some distance from the wreckage sites; 
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c) major missing parts; 
d) evidence from autopsies, such as burns or smoke inhalation of victims; and 


e) suspicion of the involvement of explosives or sabotage. 


8.3 TYPES OF RECONSTRUCTION 


8.3.1 There is a whole range of degrees and complexity of wreckage reconstruction that may be appropriate for 
the particular investigation. 


Simple layout 


8.3.2 The decision to perform a simple two-dimensional wreckage layout is usually easy to make. The 
reconstruction might be done, for example, as a structural group activity, with the structures group chairperson making 
the decision. The cost of such a layout can be very low since it can often be accomplished with existing personnel and in 
existing space. Some sort of a layout like this is done in many accidents. It is useful to lay out a few pieces to visualize 
their relationships, to look for witness marks or to examine burn or smoke patterns. 


8.3.3 In many cases, this may be all that is necessary to assist the investigator in determining probable cause. 
The simple layout is often the starting point for a more formal decision to go further. 


8.3.4 All reconstructions have the added benefit of providing a visual inventory of the wreckage recovered. 


Comprehensive two-dimensional reconstruction 


8.3.5 These are also commonly done and can be extensive, but still quite cost effective. The tools to make a 
larger two-dimensional reconstruction can be a tape measure, masking tape, some chalk, a clean floor and basic 
technical information. It can be indoors or outdoors. The need for a roof would be driven by the expected length of the 
investigation and the weather. For technical information, the investigation team will need a diagram, probably from the 
manufacturer, of the area under study. 


8.3.6 Once the tape measure and chalk have been used to mark the outline of the area to be mocked up, putting 
down masking tape will help with the visualization. It is recommended that the area to be reconstructed be “scaled-up’. 
Scaling-up means providing additional space between the pieces by enlarging the space allotted for the layout by up to 
20 per cent. This allows investigators to walk between the pieces to visualize/examine them as well as facilitate moving 
the parts into position. It will also assure that torn edges will not rub one another and damage the fracture surfaces or 
remove other evidence. Further, it will provide extra space for laying out the upper and lower surfaces in the same area, 
although for detailed layouts separate areas would be used for the two surfaces. A two-dimensional reconstruction can 
eventually be converted to a three-dimensional reconstruction, if needed. 


Three-dimensional reconstruction 


8.3.7 These can be the ultimate in physical reconstruction, depending on their extent. However, three- 
dimensional reconstructions are much more costly because of the demands for space and human resources. The 
physical facilities will be in use longer because of the length of time the reconstruction will be under construction and 
preserved. Some large three-dimensional reconstructions may require the formation of a separate “reconstruction group” 
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to staff and manage the process. Further, significant effort will be expended on a database to track the parts being hung 
on the frame. On a major reconstruction, the frame alone can cost tens of thousands of dollars. The overall cost for a 
major reconstruction can run into several millions of dollars. 


8.3.8 A three-dimensional reconstruction has distinct advantages that no other investigative tool offers. It can 
show the presence or absence of causes, such as penetration or missile impact. It will create sightlines which could 
provide other clues. These may help reduce or eliminate pet theories. On the other hand it may allow an insight that 
didn't exist before. It may eliminate or confirm potential criminal activity. It can give a good visualization of missing pieces. 
Three dimensional relationships are easier to visualize, especially those involving fire or smoke patterns or curling and 
bending of parts. 


8.3.9 Three-dimensional reconstructions sometimes do not add much to the technical understanding, and it is 
difficult to keep them simple, safe and uncluttered. Some believe that an extensive reconstruction is rarely required for a 
technical investigation. Rather, they are important for non-technical reasons. They can provide both public and political 
support for the investigative agency in need of recognition, budget or human resources. This is important to understand 
and appreciate. There can be good and valid reasons and demands, besides technical, that may sway a decision for a 
reconstruction. 


8.3.10 Once a major reconstruction gets started, it is difficult to stop the momentum, even if the thrust of the 
investigation changes. The decision process of where to stop and how much of the airplane really needs to be 
reconstructed should be determined ahead of time by the right people involved in the investigation. The investigation 
team must understand that there may be a need to preserve the three-dimensional reconstruction for non-technical 
reasons years or decades beyond its value to the investigation. Whenever possible, it is a good idea to develop an “exit 
strategy” or set of criteria that can be used to stop the reconstruction effort when further work would provide little or no 
benefit. 


8.4 RECONSTRUCTION AT THE ACCIDENT SITE 


8.4.1 Reconstruction, particularly in respect of specific components, is frequently employed at the accident 
scene. This is especially true if the accident has occurred in a relatively open area and the weather is not unusually 
inclement. Before the reconstruction work is begun, the procedures outlined in Part Ill, Chapter 2, should be followed, i.e. 
overall photographs made, wreckage distribution chart completed, a walk-around inspection made, and adequate notes 
made on the manner in which the various pieces were first found. 


8.4.2 Parts are collected, identified, and arranged on the ground in their relative positions. Major components 
such as the wing, tail and fuselage are often laid out separately from one another for ease of examination. If the 
suspected area is at the junction of the major components, the areas are sometimes reconstructed separately. Individual 
cable runs with their associated components are usually laid out separately, again for ease of examination. If significant 
markings are found on any of these latter items, corresponding markings can be sought out in the relative position in the 
aircraft. 


8.5 RECONSTRUCTION AWAY FROM THE ACCIDENT SITE 


8.5.1 Very often the location of the accident or the prevailing weather conditions precludes the reconstruction at 
the accident scene. In this case, the investigator must decide whether or not it is warranted to transport the wreckage to 
another location for reconstruction. Since additional damage will possibly be done to the various wreckage pieces during 
transportation, the investigator should ensure that a complete set of notes exists on all significant smears, scores, tears, 
etc. All major pieces should be suitably tagged, identified, photographed and recorded on a wreckage distribution chart. 
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8.5.2 The minimum amount of disassembly should be done. If it is necessary to disconnect bolted assemblies, a 
record should be made of the sequence of the various washers, spacers, nuts, etc. In many cases control cables will 
have to be cut to separate portions of the wreckage. When this is done, care should be taken to identify and tag all cuts. 


8.5.3 Unless these simple precautions are followed, valuable evidence may be lost or the investigator’s task 
considerably magnified. 


8.5.4 When the reconstruction is done away from the accident site in a hangar, for example, it is usually possible 
to do a more complete job of reconstruction. It is most helpful to have available an aircraft of the same type for 
comparison purposes. 


8.6 VIRTUAL RECONSTRUCTION 


8.6.1 As computer power grows and methods of digitizing objects improve, there is a growing interest in the 
virtual reconstruction, along the line of computer-aided design (CAD) programmes currently used to design parts or 
manufacturing processes. Much of the software is still being developed so investigators should research the latest 
available techniques and software. At the time of this writing, a virtual reconstruction is typically done after the three- 
dimensional reconstruction is in place. It is good for cataloguing the recovered pieces and determining what may be 
missing. It provides another option for the investigator, but its cost and pros and cons are still to be determined. 


8.6.2 One of the possible downsides of this new technology is the ability to manipulate digitized data and the 
need for systems that assure absolute data security. 


8.6.3 Eventually, it may be possible to jump directly to a virtual reconstruction, bypassing the need for a physical 
two-dimensional or three-dimensional reconstruction. Eventually, the technology may allow us to go underwater using 
remotely-operated vehicles, digitizing parts in place, thus eliminating the need to bring them to the surface. Further it 
may be possible to do very close-up digitizing of fracture surfaces, burn patterns and other features, and apply them to 
the frame separately. 


8.7 IDENTIFICATION OF WRECKAGE 


8.7.1 One difficulty in reconstructing a component such as a wing lies in the identification of the various 
wreckage pieces. If the wing has broken up into a relatively few large pieces, the task is much simplified. If it has broken 
up into a large number of small pieces, as with a high speed impact, the reconstruction task may be extremely difficult. 


8.7.2 The most positive means of identification is through part numbers which are stamped on most aircraft parts. 
These can be checked against the aircraft parts catalogue. When part numbers are unreadable or not found, indirect 
methods must be resorted to for identification. The colouring (either paint or primer), the type of material and 
construction, external markings, material thickness, fastener size and spacing, all can be used to assist in the 
identification of different parts. For large sections, such as spar chords, it is often possible to match the two halves of the 
fracture. The identification process is sometimes puzzling, since many pieces are bent out of normal shape. 


8.7.3 If possible, use personnel from the airline or the manufacturer who are familiar with the area being 
reconstructed. They can often identify parts and their location by subtle means such as material, fasteners, finishes or 
thickness. Of course, having adequate drawings of the area is also imperative. Since most reconstructions are fast- 
paced and fluid processes being done under tight time constraints, having a way to transmit drawings and data 
electronically is another consideration. 
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Wreckage cataloguing 


8.7.4 Especially with large reconstructions, it is important to have a system to catalogue the individual pieces of 
wreckage. Of primary importance is noting the geographic location where the particular wreckage was recovered by 
reference to a wreckage map grid, latitude and longitude, or other appropriate reference system. A brief summary of any 
significant evidence, such as fire damage or sooting, corrosion, pre-existing cracking, etc. should also be included. 
Reference to photographs or sketches might also be recorded in the wreckage catalogue. Additional information, such 
as when the item was recovered and by whom, may also be appropriate. 


8.7.5 Computer programmes, especially those in which photos or other information can be electronically linked 
to the wreckage item, can be particularly useful. An associated mapping programme where all or selected pieces of 
wreckage can be plotted on a map or grid is especially helpful. 


Examination of pieces 


8.7.6 The chief purpose of reconstructing wreckage is to permit a detailed examination of the various wreckage 
pieces. When the various parts are placed in their correct relative positions, it is possible to study the continuity (or lack 
of continuity) of damage on associated pieces. If wrinkles in one skin panel section are continuous across a tear or 
break into another panel, then determination of the forces causing wrinkling or deformation is most useful in 
differentiating between in-flight damage and impact damage, or between primary and secondary fractures. The 
continuity of smears and scores across breaks are additional points to note during the detailed examination. In-flight fire 
versus ground fire can be distinguished in this same general manner. 


8.7.7 If fatigue or deformation of certain flight controls or structures is suspected, it may be useful to visit similar 
operating aircraft with similar numbers of flight hours and cycles in order to observe the condition of these controls or 
structures due to normal operating conditions. This may also lead to the investigation or observation of airframe 
modifications or repairs if such are related to this area of concern. 


8.7.8 Overall failure patterns, including directional indications of the forces involved can usually be determined 
by relating the damage of individual pieces. The manner and direction in which fasteners are sheared is a useful 
indication in this work. Experts looking at fracture surfaces such as fuselage skins can often determine the sequence of 
breakup and the direction of tearing. 


8.7.9 Good notes and sketches should be made throughout this detailed examination. When it will add to the 
clarity of the accident report, photographs of the reconstruction, including close-ups of significant details, should be 
taken. Digital photographs, using flash and including measuring scales may provide the best details and flexibility for 
future analysis. 


8.8 SUMMARY 


8.8.1 The decision process for performing a reconstruction is just a part of the overall management of an 
investigation. Typically, investigation management includes considering resources and their allocation, the people and 
their assignments, budget, travel and research. The reconstruction decision is distinct, but must fit with the overall 
resources allocations of the investigation. 


8.8.2 Simple, two-dimensional reconstructions of some or all of the wreckage can be relatively easily performed, 
depending on the relative sizes of the wreckage and given adequate space and weather conditions. Increased effort, 
cost and time is required if the wreckage needs to be moved away from the wreckage site for reconstruction. Normally, 
extensive two- or three-dimensional reconstructions are needed only for events that involve (or are suspected to involve) 
in-flight structural breakup, collisions, fires or explosions. 
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8.8.3 Three-dimensional reconstructions of any significant amount of wreckage can be very expensive and time 
consuming, and is infrequently necessary. The future may allow computer-based virtual reconstructions, with or without 
the need for physical reconstruction of the wreckage. These reconstructions, however, require particular resources, 
thought and planning, and the decision to proceed may often involve many important, but non-technical decisions. As 
with all major investigative activities, good judgment and careful consideration of costs and benefits is essential. 





Figure Ill-8-1. General view of wing mock-up 
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Figure Ill-8-2. View of right-hand wing upper surface at outboard failure 
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Figure Ill-8-3. Systems Reconstruction Layout of Swissair 111 
(Courtesy of Transportation Safety Board of Canada) 
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Figure Ill-8-4._ Forward nine metres of Swissair 111 fuselage reconstruction on 
specially designed frame allowing both exterior and interior reconstruction 
(Courtesy of Transportation Safety Board of Canada) 
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Figure Ill-8-5. Reconstruction of TWA 800 main fuselage section 
(Courtesy of U.S. National Transportation Safety Board) 


Chapter 9 


STRUCTURES INVESTIGATION 


9.1 STRUCTURAL MATERIALS 


General 


9.1.1 The means for construction of modern aircraft — or any type of structure — come from a basic group of five 
kinds of materials: metals, composites, ceramics, polymers, and semi-conductors. These materials vary widely in their 
mechanical and physical properties, a feature which is key in design, processing, and performance applications. 
Variations in properties also help explain the difference in failure modes of materials. 


9.1.2 The majority of aircraft flying and being produced today rely on metals and their alloys for their construction. 
In general, metals and alloys are characterized by relatively high strength, high rigidity or stiffness, load-bearing 
capabilities, and good electrical and thermal conductivity. However, the trend toward more exotic materials will require 
expansion of existing structures investigation techniques. 


9.1.3 It is not necessary that every flight safety professional be an expert in the technology of materials. 
However, the more knowledgeable an investigator becomes in these subjects, the more effective he or she will be in 
determining causes of failures in structural components. 


Unit cells 
9.1.4 The unit cell is the building block of the solid material, and is the smallest constituent that retains the 
overall characteristics of the larger aggregate. In the case of aircraft structural metals, nature arranges the atoms in 
three geometric shapes or crystal structures. Therefore, it is accurate to describe metals as crystalline materials. The 
three types of interest here are shown in Figure Ill-9-1. 


Body-centred cubic (BCC) 


9.1.5 The body-centred cubic structure consists of nine atoms, as shown, and is found in a number of common 
metals. These include chromium (Cr), iron (Fe), molybdenum (Mo), and tungsten (W). 


9.1.6 For the investigator, the key point is that the body-centred cubic metals are brittle materials and this affects 


how and where they are used in an aircraft. Brittle materials tend to be strong and can carry high loads, but when they 
fail, they do so without warning. They also can shatter under impact loads, as cast iron often does when dropped. 


Il-9-1 
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BCC FCC 
Body-centred Face-centred Hexagonal-close- 
cubic cubic packed 


Figure IIl-9-1. Common crystal structures 


Face-centred cubic (FCC) 


9.1.7 Face-centred cubic cells contain fourteen atoms. This structure is found in metals such as aluminium (A/), 
copper (Cu), gold (Au), iron (Fe), lead (Pb), nickel (Ni), and silver (Ag). The key point here is that these metals are 
members of the group known as the ductile materials. 


9.1.8 Ductile materials are those that can deform, or change shape, extensively before breaking. This property of 
ductility is very important since it is what allows us to achieve the complex shapes needed in construction of aircraft and 
other structures. Unlike brittle materials, ductile metals can absorb considerable kinetic energy in impact situations, 
which further increases their utility. 


Hexagonal-close packed (HCP) 


9.1.9 The HCP crystal structure shown in Figure III-9-1 applies to a number of metals of interest. These include 
beryllium (Be), cobalt (Co), magnesium (Mg), titanium (Ti), and zinc (Zn). 


9.1.10 We find both brittle and ductile materials here. For example, cobalt is very brittle at room temperature, but 
can be alloyed with iron for high temperature steel applications. Magnesium is very ductile and can be used in its basic 
form or as an alloying metal. And titanium can possess more or less ductility depending on the applied methods of heat 
treatment and processing. 


The crystal lattice 


9.1.11 The next level toward a recognizable component is the crystal lattice. This geometric structure is formed by 
the aggregation of many unit cells to produce a repeating pattern similar to the example in Figure III-9-2. 
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Single crystal strength 


9.1.12 If the crystal lattice is perfect (or very nearly so) in every respect, we have what is called a single crystal. 
This requires the proper atom in every lattice site, no foreign atoms in the structure, and no distortions in the spacings. If 
these requirements are met we achieve close to the theoretical strength of the metal. Since the theoretical strength may 
be as much as 10 to 100 times the normal strength, the advantages of single crystals are obvious. Production of single 
crystal materials is an expanding technology. At present there are single crystal turbine blades in service in turbojet 
engines with more components expected to follow. 


Grains 


9.1.13 Grains are microscopic parts of a material wherein the arrangement of atoms in the crystal structure is the 
same. It is the orientation of the lattice that is different from adjoining parts, thus forming a collection of grains. (Grains 
can be seen at magnifications of about 2 000). 


9.1.14 The formation of grains can be appreciated by considering a vat of melted copper, which is allowed to 
refreeze. Because the temperature is not homogeneous throughout the vat, rebonding of the copper atoms into the face- 
centered cubic structure takes place in different directions. This causes a mixed orientation of the growing lattice 
structures and thus the growth of grains. 


Grain boundaries 


9.1.15 Where adjoining lattice structures meet, a grain boundary is formed. This is shown in Figure II|-9-3 for the 
case of three converging crystal structures. 


9.1.16 The grain boundary is an area of uneven spacing between atoms. This creates compression where atoms 
are abnormally close, and tension where atoms are unusually far apart. These conditions are important since minimum 
distortion aids in the mechanical interlocking of grains and thus increases the strength of the material. On the other hand, 
excessive spacing not only mechanically weakens the material, but also may allow fluids to invade the boundary areas 
and foster corrosion. 


Grain size 


9.1.17 Properties of a material can often be determined by controlling the size of the grains. Grain size is partly 
inherent in the type of material, but is also a function of the rate of cooling, subsequent tempering (heat treatment), and 
mechanical factors in processing, as in rolled steel or aluminium. 


9.1.18 In general, slow cooling produces large grains and greater ductility in a material. Rapid cooling (quenching) 
produces small grains and strong, but brittle, materials. Rolling, in the manufacturing process, causes grains to become 
elongated and more aligned in the direction of rolling. 
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Figure Ill-9-2. Representative crystal lattice (unit cell emphasized) 





Figure IIl-9-3. Typical grain boundaries 
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9.2 TYPES OF MATERIAL FAILURES 


Major component failure 


9.1.19 The relative incidence of in-flight failures or separation of some major component such as the wing, tail 
surface, aileron, control system or fuselage is approximately in that order, with major failures of the fuselage or control 
system occurring very infrequently. In general, major component failures result from either (1) inadequate design 
strength, or (2) excessive loads imposed upon the component, or (3) deterioration of static strength through fatigue or 
corrosion. 


9.1.20 Since all civil aircraft are designed and tested to at least the minimum standards of the pertinent national 
regulations, failures directly attributable to inadequate design strength are remote if the aircraft is operated within its 
design limitations. Sometimes, however, especially when the aircraft is first introduced, different loadings are 
experienced from those anticipated and static failures occur within the operating limitations. This seldom occurs, but a 
certain amount of suspicion should always be directed to failures involving new designs. Most of the component failures 
attributable to inadequate design strength are usually associated with deficient repair or modification work, or with an 
improperly manufactured part or component. Since the manufacturer’s standards and procedures are supervised by 
government and industry agents, major manufacturing mistakes are kept to a minimum. Faulty repair or modification 
work is responsible for a large proportion of failures in this grouping. In this respect, verification of manufacture approved 
replacement parts and repair on modification procedures is essential. 


9.1.21 Excessive loads are developed when an aircraft is operating outside of its limitations of load factor and/or 
speed. Very often these large loads are imposed inadvertently, such as during the recovery following a loss of control at 
height where the aircraft enters a rapid descent, for example when entering thunderstorm activity or icing condition or 
when performing aerobatic manoeuvres. At other times the pilot may perform severe manoeuvres for which the aircraft 
was not designed. In either case, the loading on the wing, tail, fuselage, etc., builds up to a value in excess of the design 
limit and static failure results. The circumstances immediately preceding the failure as developed from witness 
statements can be most helpful in establishing excessive loads as the direct cause. 


9.1.22 Fatigue failures continue to be one of the major causes of structural failures of aircraft parts and 
components. This basic cause should always be strongly suspected until other facts or circumstances are developed to 
disprove it as a factor. As indicated in the section on “Fatigue”, this type of failure can result from a number of causes. In 
general, fatigue failures are due to either (1) inadequate design, or (2) poor maintenance, or (3) defective manufacturing, 
or (4) alternating loadings not anticipated by the designer. The majority of fatigue failures result from imperfect detail 
design and from improper installation or handling of the part. Since fatigue is usually associated with large numbers of 
cycles of repetitive loading, this type of failure is rarely found in new aircraft with low service time. Regions that 
experience higher than normal accident rates also exhibit older aircraft that often operate under difficult environmental 
conditions with minimum preventive maintenance or fatigue analysis. 


9.1.23 In addition to the three basic causes for in-flight structural failure cited above, there is a special type of 
failure associated with flutter. Flutter is an instability type of phenomenon involving a self excited oscillatory system and 
its occurrence is dependent upon the interrelationship of the aerodynamic forces, inertia forces and elastic forces of the 
system. When flutter does occur the amplitude of the oscillation may build up and extremely high loads may develop, 
resulting generally in structural failure of the aircraft or one of its components. For this reason, flutter can be considered 
as a special variation of excessive loading and can be handled by the investigator in the same general manner as for 
that category of failure. Modern aircraft are designed and tested during certification to avoid the possibility of flutter in 
normal use. However, flutter can occur in service, if the original design or component stiffness is altered by repair or 
modification work or if excessive free play develops. 
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9.1.24 When investigators are faced with the task of determining which component failed first, they may be aided 
by the fact that a major component will almost always separate from the aircraft after failure. And since separation takes 
place, the component can be found at some distance from the main wreckage. When a component or components 
separate at a low altitude, they are strewn along the flight path approximately in the order of their separation. When a 
component or components separate at a high altitude, the interrelationship of component mass, aerodynamic shape, 
speed at separation and winds aloft all affect the trajectory of the part and careful study of these factors is required to 
determine the order of separation from the ground wreckage trail. Methods are available to approximate the trajectories 
of wreckage parts, and investigators have had considerable success in evaluating the significance of wreckage trails in 
accidents of this type. The study of the wreckage distribution and reconstruction of the aircraft plays a significant role in 
the determination of the sequence of failure. Other techniques are also available and they are referred to in subsequent 
sections. 


Partial failure or malfunctioning 


9.1.25 Accidents in this general category are by far the more difficult to investigate, since no obvious evidence 
such as a wing being found two miles from the main wreckage scene is usually available on which to make a rapid 
determination. Partial failure or malfunctioning of a major component generally results in altered flight characteristics and 
these in turn are responsible for the accident. Some of the general causes of accidents in this category are jammed 
controls, improper distribution of load on board, control surface not rigged properly, incorrect installation of parts, hard- 
over signals from auto-pilots, etc. Accidents of this type are frequently associated with recent repair or alteration work; 
therefore, the investigator can often discover valuable clues by studying the aircraft's history as reflected by 
maintenance entries, pilot reports and by other sources. 


9.1.26 The general procedure used for accidents in this category is to follow routine investigatory practices, 
systematically checking out various leads and clues until the cause is determined. Certain techniques are available to 
reduce the amount of work required to complete the investigation; of these, the elimination technique is one of the most 
useful. In most accidents, an experienced investigator can quickly eliminate unlikely possibilities, e.g. by reference to the 
type of impact, and can isolate the general area in which the initial difficulty is located. The reconstruction technique is 
most helpful at this stage of the investigation. 


9.3. EXAMINATION OF THE AIRFRAME INCLUDING LANDING GEAR AND FLIGHT CONTROLS 


Smears and scoring 


9.3.1 For the investigator at the accident site, making a determination as to which parts failed in-flight and which 
failed on impact can be extremely difficult. Nevertheless, helpful information can be obtained from a careful study of 
parts of the wreckage. When possible, this study should be made before the wreckage is disturbed since movement of 
the wreckage may destroy valuable clues or create misleading ones. The study and analysis of wreckage smears and 
scores is an extremely valuable aid in the investigation of collision accidents. 
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9.3.2 A smear can be defined as a deposit of paint, primer, oil film or other materials transferred from one part to 
another part during the process of the two sliding or rubbing across each other. This sliding or rubbing action frequently 
occurs after an in-flight structural failure. For example, a failed wing panel often makes such a contact with the rear 
portion of the fuselage or tail section. If the wing panel had been painted with a distinctive colour, it would be normal to 
find coloured smears on the fuselage or tail components. These paint smears usually pile up against protuberances, 
such as rivet heads or skin laps. The direction of the smearing force can generally be determined from the fact that the 
pile-up of paint will be found on the side of the protuberance away from the direction of the applied force. Smear 
deposits are sometimes found in the recessed slots of screws. In some cases, excess deposits are pushed out from the 
ends of the slots and deflected over in the direction of the smearing force. If the investigator cannot make a preliminary 
determination and if it is believed that the smears may contain valuable clues, the investigator can resort to laboratory 
examinations. This type of examination can usually reveal the nature of the smear substance, and can usually pinpoint 
the direction of the smearing force. 


9.3.3 Score marks are produced when one part slides or scrapes across another. The score marks result when 
some sharp edge on one of the pieces gouges the other piece. Sometimes only the paint film is gouged, while more 
frequently actual metal is gouged and an indentation or trough is formed. Close examination of the score marking under 
a magnifying glass or microscope will reveal directional markings and metal residue which is deformed in the direction of 
the scoring force. When a skin panel containing a protruding rivet head seam strikes a glancing blow in a painted skin 
panel, a series of parallel score-markings in the painted film is usually produced. If corresponding smear deposits can be 
found on a particular row of rivets, and knowing the rivet pitch, the relative position of the two bodies during contact can 
usually be established. This type of determination is often helpful in many investigations. Score marks can often be used 
to establish that the damage occurred prior to impact and not afterwards. If score marks are found on several related 
pieces of wreckage, the consistency and continuity of the scores across the pieces after they are placed in their relative 
positions will show that the scoring was made before the pieces were torn apart. This type of evidence can often be 
used to establish that the scored component struck or was struck by another component, thus leading to a logical 
sequence of in-flight break-up. 


9.3.4 Many other distinctive markings are often found on pieces of wreckage and a careful study of such 
markings will very often provide many valuable clues. When a rotating propeller cuts through metal, it leaves a very 
distinctive saw-toothed pattern. The jagged “teeth” are deformed in the direction of the cutting force and curled over in 
an easily distinguishable manner. The amount of curling, the extent of the jaggedness, the length and width of the cut, all 
provide indications of the propeller torque and forward speed during the cutting interval. An aircraft control cable is 
another item which produces a distinctive marking when it strikes or is dragged across a skin panel. In this case, the 
general indication is a series of tiny parallel lines. The exact shape and size of these cable markings can often be used 
to determine the direction in which the cable was moving when the markings were made. Peculiarly shaped indentations 
on parts or on skin panels can sometimes be matched with the piece which made the indentations and thereby provide a 
clue to the sequence of failure. On the other hand, it is sometimes possible to be misled by cutting marks produced by 
an axe or hacksaw used in the salvage operation, and the investigator should become familiar with this type of marking 
and to distinguish this type from the others described. 


Wings, fuselage and tail unit 


9.3.5 As part of the initial structure examination, the investigator should look for evidence that any main part of 
the structure was not in its correct relative position at the time of impact. Wreckage distribution marks on the ground and 
telescoping of components often provide valuable clues. Evidence of missing pieces and overstressed sheet metal is 
also quite helpful. 
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9.3.6 Components such as cables, pulleys, hinges, and balance and tab mechanisms should be examined 
closely to determine whether observed failures are the result of design deficiencies, wear, inadequate maintenance or 
impact. 


9.3.7 Examination of the main portion of the fuselage should include an assessment of the actual load 
distribution in so far as possible. The figures thus obtained should be cross-checked against the weight and balance 
sheet. 

Landing gear 
9.3.8 The link mechanism, up and down locks and position of the operating jacks or actuating cylinders should 
be examined to ascertain whether the landing gear was up or down. If the gear has failed or separated, note the 
direction of the force which caused the failure or separation. 


Flight controls 


9.3.9 To the maximum extent possible, all controls, both manually and power operated, should be traced out and 
inspected carefully to assure that all component parts are accounted for. 


9.3.10 Tailplane incidence, tab and flap settings should be noted and compared with their respective setting 
indicators in the cockpit. 


9.3.11 All operating levers and the attachment of control rods or cables to these levers should be checked to 
determine whether they were properly assembled, adequately lubricated and not jammed. 


9.3.12 Spoilers, where installed, should be examined to determine whether they were extended at the time of 
impact and whether any failure occurred in their mountings. 

Cockpit 
9.3.13 Recording and photographing the positions and settings of all cockpit controls, switches and circuit 


breakers can aid in the structures investigation. These functions are normally accomplished in the systems and 
operations phases of the investigation. 


9.4 FATIGUE OF MATERIALS 


General 


9.4.1 Fatigue can be described as the process of damage and failure due to repeated, or cyclic, loading of a 
component. The stresses involved may be well below the ultimate strength of the material, but they can create 
microscopic cracks or other damage that lead to failure of the part. 
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9.4.2 In order for fatigue cracks to form and propagate in metals, there are three requirements or conditions to 
be met: 


a) alocal plastic stress (stress concentration); 
b) tension stress; and 
c) cyclic (fluctuating) stress. 


Requirements b) and c) will exist anytime the aircraft is in operation. With regard to these requirements, operators and 
maintainers should be aware that elimination of any one of the three can stop the fatigue process, and personnel can 
play a vital role in the incidence of fatigue in structures. 


9.4.3 In general, fatigue failures are the result of fatigue cracks. These cracks most often originate in areas of 
high stress concentration (localized plastic stress). Some of these stress concentrations — also called stress raisers, 
stress risers, or stress magnifiers — are internal to a metal. Impurities, voids or other flaws may constitute internal stress 
raisers. However, the majority of stress raisers occur on the surface of the metal. These include design features such as 
fastener holes, sharp corners, sharp threads, etc., and in-service flaws such as nicks, gouges, scratches, tool marks, 
and the like. 


9.4.4 The increase in stress created by drilling round or elliptical fastener holes, for example, can be found in 
good approximation by use of the stress concentration factor, K. K is defined as: 


_ maximum actual stress 
nominal stress 





K 


where the nominal stress is the tension stress in our plate before drilling, given by f =— : 


In practice, we find a good approximation of K in our drilled plate is given by K =1+2{2) . The dimensions a and b with 


respect to the load are shown in Figure IIl-9-4. We see that as the hole becomes more elongated, the value of K goes up 
rapidly. Conversely, as the dimensions approach a smooth circle, the value of K approaches 3. 


Recognizing fatigue failures 


9.4.5 The complete story of a fatigue failure is in almost all cases set forth on the face of the fracture. In other 
words, much valuable information relative to the magnitude and direction of loading and to the presence or absence of 
stress concentrations can be developed through a careful study of the fractured surfaces. Interpretation of the fracture, 
however, may not always be a simple matter, because each case may be influenced by many variables. Some of the 
variables have been briefly touched upon in previous sections. Some contributing factors, like decarburization — the 
loss of carbon from the surface of a ferrous alloy as a result of heating in air — can only be verified by laboratory 
examination. In many cases, on the other hand, the cause can be pinpointed in the field by careful study of the fracture 
alone. 
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Figure Ill-9-4. Stress concentration factors for elliptical holes 


9.4.6 Fatigue failures occur without perceptible ductility (plastic deformation), as contrasted against static failures 
where considerable ductility or “necking down” generally takes place. This distinction is often helpful in isolating a part 
which has failed from fatigue. All brittle failures, however, are not necessarily fatigue failures and this feature must be 
used with other features to be described before a final determination is made. In addition, most fatigue failures (some 
torsion-fatigue failures exempted) occur on planes which are at right angles or nearly at right angles to the loading. On a 
large number of parts the fatigue plane will be perpendicular to the axis of the part, and in the fatigue area the fracture 
will generally be in one plane. Irregular fractures, therefore, when the fracture slips from one plane to another and when 
these planes are very much different from a plane perpendicular to the loading or to the axis of the part, are very 
probably not fatigue fractures although close examination is often required to see if some small area on the fracture 
does not conform to the basic requisites. The two features of a fatigue fracture referred to in this paragraph are 
extremely useful in ascertaining a fatigue failure from a large number of failures. In fact, in those cases when the 
fractured surfaces are mutilated from subsequent damage, these features may be the only ones available to distinguish 
between fatigue and static failures. It is most desirable that, in making determinations of this type, both halves of the 
fracture are available for examination. In this respect, investigators must be cautioned not to try to “fit” these parts 
together as this will destroy the stop marks on the two surfaces. 


9.4.7 As indicated previously, the most valuable information is contained on the fracture surface itself. The actual 
fatigue fracture surface is composed of two distinct regions: one smooth and velvety — the fatigue zone; and the other, 
coarse and crystalline — the instantaneous zone. The smooth, velvety appearance of the fatigue zone is caused by 
rubbing of the mating surfaces as the crack opens and closes under repeated loading. The coarse appearance of the 
instantaneous zone has given rise to the erroneous “crystallization theory”. For many years, people in examining a 
fatigue fracture or in discussing them were accustomed to saying that the part had failed because it “crystallized.” We 
now know that this is untrue since all metals are crystalline in the solid state. 


9.4.8 The first task, then, in searching out a fatigue failure is to look for the two distinct types of zones on the 
fracture surface — the fatigue zone and the instantaneous zone, as shown in Figure IIl-9-5 and Figure Ill-9-6. 
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Figure IIl-9-5. Typical fatigue failure of a ductile material 





Figure Ill-9-6. Fatigue fracture. Note the smooth, velvety appearance of the fatigue zone with 
clear stop marks and the coarse appearance of the instantaneous zone. 
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9.4.9 In many fractures, more than one fatigue zone can be found, indicating that several fatigue cracks had 
developed and were progressing at the time of the final failure. In each fatigue zone, the origin of the fatigue crack can 
be found by locating the point from which the crack front progression marks radiate. These fatigue progression marks 
are curved lines on the fracture surface and are variously known as “clamshells”, “oyster shells’, “beach marks”, or “stop 
marks”, and are found in almost every service fatigue failure. It should be noted here that under some loading conditions, 
particularly where the load cycles are relatively constant, the fatigue crack may grow without leaving distinctive 
progression marks. In these cases, the fatigue fracture can usually be identified by its smooth, velvety appearance or by 
single fracture planes approximately perpendicular to the direction of loading and by the absence of plastic deformation. 
Any suspicious or dubious fractures should be referred to a specialist for confirmation. 


9.4.10 The many crack front marks in a typical fatigue fracture that occurs in service are caused by various 
degrees of rubbing as the crack either stops for certain periods or as it progresses at varying rates under different stress 
levels. For this reason, the term “stop marks” as it is applied to the crack front marks is perhaps more pictorial than the 
other commonly used expressions since it indicates a hesitancy in the crack progression. Laboratory fatigue specimen 
failures very seldom show “stop marks” because most fatigue-tests are conducted with constant load amplitude. “Stop 
marks” are usually concave toward the fracture origin but the curvature varies greatly, depending on the shape of the 
part, the degree of stress concentration, and the type of loading. 


9.4.11 The investigator should also note the relative sizes of the two zones since this can provide a qualitative 
estimate of the cycles and stress levels involved. When the fatigue zone is large compared to the instantaneous zone, it 
is an indication of low stress levels and a large number of cycles before failure. Conversely, a large instantaneous zone 
says high stress led to failure in a smaller number of cycles. The terms high-cycle fatigue and low-cycle fatigue are often 
used to describe these conditions. In this regard, low-cycle generally refers to a range of hundreds or thousands of 
cycles, while high-cycle indicates numbers into the millions. 


9.4.12 It should be reiterated that fracture analysis as such is a complex problem and that this document cannot 
hope to cover the countless variations. However, knowledge of the material in the following sections should enable the 
investigator to recognize and diagnose the majority of service fatigue failures likely to be encountered. 


Bending fatigue failures 


9.4.13 Bending fatigue failures can be divided into three general classifications according to the type of bending 
load imposed. These three types are one-way bending, two-way bending, and rotary bending. Most bending fatigue 
failures in service will fall into one of these categories. (See Table IIl-9-1). 


9.4.14 One-way bending fatigue fractures occur when a fluctuating bending load produces stresses above the 
endurance limit of the material only on one side of a part. The endurance limit of a material can be defined as that level 
of stress below which there is a 50 per cent or less chance of fatigue getting started. Under this type of loading, the 
stress is generally at a maximum at one point on the outer surface of the piece and a fatigue crack will start here if the 
stress is above the endurance limit and if it is repeated long enough. Under two-way bending loads, tensile stresses 
occur on both sides of the neutral axis and, when the stress level and number of loadings are of the right order as before, 
cracks will start on both sides of the part and progress toward the centre. Rotary bending occurs when a part is rotated 
while under a bending loading. A typical example of rotary bending would be an engine crankshaft or a railroad axle 
under service loading. 


9.4.15 In each case, the stress level affects the relative size of the fatigue and instantaneous zones. When the 
stress level is low, the fatigue zone is large and vice versa. Stress concentration affects the general curvature of the 
fatigue stop marks. Point sources of stress concentration tend to decrease the radius of curvature close to the origin and 
line sources tend to result in multiple cracks that join to form a crack front roughly parallel to the line of stress 
concentration. 
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Table Ill-9-1. Fracture appearances of fatigue failures in bending 






Stress No Stress Concentration Mild Stress Concentration High Stress Concentration 
Condition 





Low Overstress High Overstress Low Overstress High Overstress Low Overstress High Overstress 


Case a b c d e f 





One-way bending load 





2 
Two-way bending load 





3 
Reversed bending and 
rotation load 


























9.4.16 These general features, then, can be used to determine the type of bending loading applied and, 
qualitatively, the stress level and presence or absence of stress concentrations. If the cross-section under consideration 
differs widely from a symmetrical section, the actual significance of the markings as related to stress level and stress 
concentrations may be somewhat altered but, in general, the same reasoning still applies. 


Tension fatigue failures 


9.4.17 Because of initial eccentricities in a part or because of eccentric loading, pure tension loading as such 
rarely occurs in service. Usually some amount of bending accompanies tension on axial loading. However, enough 
fatigue failures under predominantly axial loading do occur in service to warrant learning how to distinguish these 
failures from bending and torsional failures. Tension fatigue failures can generally be recognized by the manner in which 
the crack has progressed into the part. Parallel or constant curvature stop markings are characteristic of fatigue failures 
resulting from straight tension loading. As in bending fatigue failures, the relative size of the fatigue zone and the 
instantaneous zone can be used as a measure of the stress level which produced the failure. 
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Torsion fatigue failures 


9.4.18 Torsion fatigue failures occur in either of two basic modes: (1) helical, at approximately 45° to the axis of 
the shaft, along the plane of maximum tension, or (2) longitudinal or transverse, to the axis of the shaft, along the planes 
of maximum shear. Fatigue stop markings may not always be found on the fracture, and secondary means such as 
absence of ductility and observing the angle of the failure plane must often be used to identify failures of this type. 
Transverse fractures are usually very smooth from the rubbing of the two halves of the fracture before final separation 
and this characteristic can be used to isolate this type. In many service torsional fatigue failures, the initial crack will start 
in one plane and then slip off into another. Helical fractures generally occur when point sources of stress concentrations 
are present. Fatigue cracks tend to follow the direction of line sources of stress concentration. In searching out torsion 
fatigue failures, the investigator is usually aided by the knowledge that torsion loading is present in the service 
application. In this regard, torsion fatigue should be suspected when examining failures of crankshafts, flap drive torque 
tubes, coil springs, splined shaft members, etc. Many parts that are subjected to torsion loads may be case hardened 
and the fracture in the case (hard surface layer) may resemble fatigue even when it is caused by a gross overload. (See 
Figure II|-9-7.) 





Figure Ill-9-7. Fatigue failure of a punch press shaft which was subjected to torsion and bending loads. 
The fatigue crack originated at a sharp fillet at a change in section. 
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9.5 RECOGNITION OF STATIC FAILURES 


General 


9.5.1 For the purpose of this document, a static failure is defined as a failure resulting from one or a small 
number of load applications. The failure is characterized by permanent distortion or rupture of the member as a result of 
stresses in excess of the yield point of the material. In ductile materials this type of failure can be recognized by yielding 
over a considerable portion of the member in the region of the failure. The phenomenon is commonly referred to as 
plastic deformation, or “necking” in the failure of a conventional tensile test specimen. Materials that have relatively little 
ductility, such as the high strength aluminium alloys, ultra high strength steels, and most castings, may not show any 
appreciable amount of necking or deformation. Impact loading may be considered as a special case of static loading 
where the speed of load application affects the magnitude of load. 


9.5.2 Static failure will occur when loads in excess of ultimate loads are imposed on the aircraft or some 
component of the aircraft. In flight, this can happen when the aircraft is manoeuvred too severely or at too high a speed. 
In landing or on the ground, this can occur when the aircraft is landed too hard or when the aircraft is taxied over an 
obstruction. The damage that results when an aircraft strikes the ground is of the static type, with impact loading being 
an important consideration. 


Common fractures in metal 


9.5.3 The yielding or “necking” effect found in most metal fractures is an indication of a static type of failure. 
Detailed examination of the deformation will disclose indications of the type of loading (i.e. bending, tension, etc.) and 
the direction of loading. In most cases, the two halves of the fracture will mate with one another or can be recognized as 
a pair. However, care should be taken not to allow actual contact of the parts since this could alter or destroy surface 
evidence that might be needed in a laboratory evaluation of the fracture surfaces. 


Tensile 


9.5.4 In a tensile failure, part or the entire fractured surface is usually made up of a series of planes inclined 
approximately 45-60° to the direction of loading. In a thin part, such as sheet metal, there may be only one such inclined 
plane. Frequently fractures on an inclined plane are called “slant fractures” or “tensile shear fractures”, while those on a 
plane perpendicular to the loading direction are often called “flat fractures”. When a predominantly flat fracture has small 
slant fractures along the edges, the slant fractures are called shear lips. Considerable local deformation or “necking” with 
a reduction of cross-sectional area is also generally evident in ductile materials. If the fracture is pure tension alone, the 
two halves of the fractures will part cleanly and there will be no evidence of rubbing. Figure IIl-9-8 shows the tension 
failure of a typical aircraft material. 


Compression 


9.5.5 Compression failures occur in two general forms: block compression and buckling. Block compression is 
generally found in heavy short sections whereas buckling is found in long, lighter sections. When buckling occurs locally, 
it is referred to as crippling. When it occurs in such a way that the whole piece buckles, it is referred to as column 
buckling. Local buckling and column buckling are easily recognized since the part in all cases is bent from its original 
shape. 
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9.5.6 In block compression failures, the piece separates on oblique planes as in tension, except that there is 
rubbing of the two halves of the fracture during separation. In addition, in some materials there is a local increase in 
cross-sectional area where the material has yielded. Figure III-9-9 shows examples of buckling and block compression 
failures. 


Bending 


9.5.7 Bending is resisted by tensile stresses on one side of the member and by compression on the opposite 
side. The appearance of the fracture in the respective areas is as outlined under tension and compression above. The 
direction of the bending moment causing failure can always be determined from local distortion in the fracture area. As 
the part finally separates, lipped edges may be found on the inside or compression face of the fracture. This lipping 
occurs because after the initial tension failure, the final failure on the compression side may be in shear rather than in 
compression. This type of failure is illustrated in Figure III-9-10. 


Shear 


9.5.8 As in compression failures, shear failures can occur in two distinct ways — block shear and shear buckling. 
In the former type of failure, the two halves of the fracture will slide across the other and the fracture will appear rubbed, 
polished or scored. The direction of scoring will give a clue to the direction of the applied shearing force. 


9.5.9 Shear buckling generally occurs in thin sheet metal such as wing skin or spar webs. The sheet will buckle 
in a diagonal fashion and the direction of force application can be told from the appearance of the buckle. Figure II|-9-11 
shows block shear and shear buckling of ductile material. 


9.5.10 When rivets, screws, or bolts fail in shear, the failure is usually accompanied by elongation of the hole and 
there will appear behind the rivet a new moon or crescent shape open space. This result can be used to determine the 
direction of the shearing force. 


Torsion 


9.5.11 Since torsion is a form of shear the failure from torsion overload will be somewhat similar to the shear 
failure. Evidence of the direction of torque can be seen on the fractured surface by observing the scoring marks. Most 
parts retain a permanent twist and this also can be used as an indication. In tubing members or a large open section, 
like the wing, torsion failures often occur as instability failures in a buckling manner. Again the direction of twist can be 
determined by close examination of the buckle. Figure III-9-12 shows examples of torsional failure. 


Tearing 


9.5.12 Tearing failures in sheet metal, or heavier sections for that matter, generally occur in two distinct forms — 
shear tearing and tensile tearing. 


9.5.13 Shear tearing occurs when the applied forces are acting out of the plane of the sheet. These failures are 
characterized by a lipping of material on the edges of the sheet and by scoring lines on the fractured surface. The 
concavity of the scoring can be used to tell the direction of tearing. The direction of tearing is from convex to concave. 
Sometimes if there is a heavy paint film, the saw-toothed breaking of the paint film can be used to tell the direction of 
tearing. 


9.5.14 Tensile tearing occurs when the sheet tears under tensile forces in the plane of the sheet or member. This 
type of fracture is quite common. Except in thin sheet material, examination of the fracture will disclose “herringbone” 
marks with the head of the herringbone pointing back to the origin of the tear. 
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Figure Ill-9-9. _Compression (buckling) failure (left); Block compression failure (right) 
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Figure Ill-9-10. Bending failure of ductile material 
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Figure Ill-9-11. Shear failures. Block shear failure of ductile material (left); 
Shear buckling of ductile material (right) 
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Common fractures in fabric 
Tensile 


9.5.15 As would be expected, fabric failures result from an overload of the individual threads. If the applied tensile 
force is parallel to the threads in the cloth, then the outstanding thread ends which have a brush-like appearance will not 
be deformed from the line of the load. If the applied tensile force is at an angle to the threads, the threads at the fracture 
will be deformed in line with the load. (Figure II|-9-13.) 


Tearing 


9.5.16 Under tearing loads, the individual threads fail in tension, but the threads are usually deformed in the 
direction of the tear. The ends of the thread present the familiar brush-like appearance. The deformation of the threads 
is much more pronounced than that which is found in tension loading at an angle to the thread line. (Figure III-9-14.) 


Teasing 


9.5.17 Teasing is the term applied to the appearance of fabric fractures which have been flapping in the airstream 
after failure. The fabric becomes unravelled, fluffy, and sometimes even tied up in knots. Sometimes this can be used as 
indication of in-flight failure. This condition can, however, be encountered on the ground under high wind conditions, and 
caution must be used in applying this particular characteristic. Some idea of the time of exposure can be determined 
from the amount of teasing present. Large amounts of teasing might indicate long exposure and/or high airstream 
velocity. (Figure III-9-15.) 


Common fractures in polymers (plastics) 
General 


9.5.18 Failures in plastic windows are difficult to evaluate because in most cases only a small number of 
fragments are available for examination. The more pieces recovered, the better the chance of determining the mode of 
failure. The general procedure used in studying failures in plastics is to piece together the available fragments and then, 
by correlating the individual failure patterns, to isolate the initial failure. Information is presented below on the 
appearance of typical tensile, bending and tearing types of fractures. In addition, there are a few general principles 
which assist in isolating the initial failure. A first path of failure terminates only at an edge of the panel and is generally a 
smooth curve. Therefore, breaks or fractures which end on other breaks can be dismissed as being secondary failures. 
All breaks should be carefully examined for evidence of bubbles, scratches, nicks or gouges. These will, in general, act 
as stress raisers, and initiate the failure. 


9.5.19 Two general types of markings in glass or plastic fractures have been identified and are in general use. 
These two markings are “rib marks” and “hackle marks”. Rib marks are similar to the familiar fatigue clamshell or beach 
marks and are curved lines radiating in the direction of the fracture propagation. The fracture direction approaches a rib 
mark on the concave side and leaves the convex side. Although rib marks are found on glass and plastic fractures 
initiated by impact, they can be produced by relatively slow tearing of glass or plastic. Hackle marks are perpendicular to 
the rib marks and are similar to the fatigue “ratchet marks” which indicate multiple cracks joining with one another. 
Hackle marks are valuable in identifying the origin of the fracture since they always point in the direction of the initial 
crack. If the source of the failure is a bubble or other flaw, the hackle marks will very often spread out in ray-like fashion 
from the flaw. 
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Figure Ill-9-12. Torsion failures. Helicopter turbine (left); Turbine engine shaft failure (right) 





Figure Ill-9-13. Fabric failures in tension. Left: Bushy appearance, fibers straight along threads. 
Right: Bushy appearance, fibers turned locally at fracture across threads. 
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Figure Ill-9-15. Teasing. Left: Fractured edges “fluffy” due to flapping in airstream. 
Right: Fracture after tearing. 
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Tensile 


9.5.20 Because of their low ductility, Plexiglass and other, similar plastics fail in a brittle manner. The failures 
generally originate at some local weak point in the material or at a scratch or gouge. The initial failure zone is usually flat, 
smooth and highly polished. Marks resembling the “herringbone” markings found in metal tearing fractures radiate from 
the origin of the tensile failure. Moving the piece back and forth to get different lighting on it will sometimes help to make 
the markings more easily discernible. 


Bending 


9.5.21 The outer or tensile side of the bend can generally be determined by looking for the flat side of the fracture 
which is roughly perpendicular to the surface. On the compression side, the failure is usually on an oblique plane and 
the compression edge is either lipped or rounded off. 


Tearing 


9.5.22 Tearing in plastics is essentially a tensile tearing under loads that are nearly in the plane of the surface. 
Very often bending effects combined with tension effects are found in tearing fractures. Curved, wave-like lines can be 
seen on the fracture radiating from the point where the tear started. These curved lines are usually perpendicular to the 
tension edge of the fracture and curve rapidly until they appear to run tangent to the compression edge. These marks 
resemble the familiar clamshell or beach marks found in metal fatigue failures and are generally referred to in plastic 
fractures as “rib” markings. 


9.6 MODES OF LOAD APPLICATION 


General 


9.6.1 The manner or “mode” of load application has an extremely important bearing on the way in which a part 
fails in service. Any breakdown or typing of variations in loading applications is at best only arbitrary since, in general, 
the difference between different types is really only one of degree. Thus one mode of load application blends into 
another as rate of loading is decreased or increased. Changes in the frequency of loading will result also in a change of 
the mode. In reality, no hard or fast rule can be stated. However, for purposes of investigation work it is sometimes 
convenient to look upon a particular loading as one type or other. For this reason, in the following discussion the various 
modes are arbitrarily divided into three types: static, repeated and dynamic. 


Static loading 


9.6.2 Static loading can be further divided into short-time static loading and long-time static loading. 


Part Ill. Investigation 
Chapter 9. Structures Investigation Ill-9-23 





Short-time loading 


9.6.3 In short-time static loading, the load is applied so gradually that all parts are at any instant essentially in 
equilibrium, i.e. the simple, conventional stress formulas can be used directly. In testing, the load is increased 
progressively until failure results and the total time required to produce failure is not more than a few minutes. In service, 
the load is increased progressively up to its maximum value, is maintained at that maximum value but for a limited time, 
and is not re-applied often enough to make fatigue a consideration. The ultimate strength, elastic limit, yield point, yield 
strength, and modulus of elasticity of a material are usually determined by short-time static tests. As will be explained 
more fully later, this is the type of loading application used in conjunction with present-day design criteria. Loads 
imposed upon the aircraft by various manoeuvres or by isolated peak gusts are generally considered as static loads. 


Long-time loading 


9.6.4 In long-time static loading, the maximum load is applied gradually as before, but the load is maintained. In 
testing, it is maintained for a sufficiently long time to enable its probable final effect to be predicted. In service, it is 
maintained continuously or intermittently during the life of the structure. The creep or flow characteristics of a material 
and its probable permanent strength are determined by long-time tests at the temperature prevailing under service 
conditions. This type of loading application is generally only important at elevated temperatures. When a part is loaded 
for a relatively long time at higher than normal temperatures, it will begin to creep or distort at a more or less uniform rate. 
The strength of the part is reduced from its room temperature value. At the present time, there are few applications of 
this type of loading in civil aircraft. However, as aircraft speeds increase and skin temperatures are sufficiently high, this 
type of loading will take on increased significance. 


Repeated loading 


9.6.5 In repeated loading, the load or stress is applied and wholly or partially removed or increased many times 
in rapid succession. This is the type of loading application which is associated with fatigue. Generally speaking, repeated 
loading implies a large number of load applications. However, under certain conditions, repeated loading of only a 
relatively few cycles can produce a similar effect to a large number of cycles. This point will be explored further in the 
discussion later on fatigue. The important point to remember at the moment is that the strength of a part is reduced from 
its static strength value when the part is loaded repeatedly. The actual amount of the reduction varies with the stress 
level and the number of repetitions. A typical example here will illustrate this point. If a round bar of 2014-T6 aluminium 
alloy is loaded in tension, the failure stress will be 60 000 psi. Yet if this same part had been loaded through a hundred 
million cycles of reversed bending load, the failure stress would be only 20 000 psi. Cycles of this order of magnitude 
can be and often are encountered within the lifetime of an aircraft. Atmospheric gusts and vibration produce a repeated 
type of loading and for some aircraft, manoeuvre loads are significant. 


Dynamic loading 
9.6.6 In the two previously mentioned types of loading, a state of equilibrium existed, i.e. the external loads were 


in balance with the internal loads. In dynamic loading, the loaded member is in a state of vibration and static equilibrium 
does not exist for a time. In broad terms, there are two classes of dynamic loading — sudden and impact loading. 


Ill-9-24 Manual of Aircraft Accident and Incident Investigation 





Sudden loading 


9.6.7 Sudden loading occurs when a weight or “dead load”, not in motion, is suddenly placed upon a member or 
structure. A beam would be thus loaded if a weight were suspended by a cord which allowed the weight just to touch the 
beam, and the cord was then cut. The stress and deflection so produced would be approximately twice as great as if the 
weight were eased on to the beam as in static loading. Any force will cause approximately twice as much stress and 
deformation when applied suddenly as when applied progressively. The actual magnitude of the “magnification factor” 
depends for the most part upon the particular type of force or load being considered and upon the stiffness of the system. 
In the aircraft field, gust loads are forms of sudden loading although, as will be noted later, they are treated as static 
loads. 


Impact loading 


9.6.8 Impact is generally associated with motion as when one body strikes another. Unusually high forces can 
be developed under impact loading. This type of loading has no direct place in aircraft design (a possible exception 
would, perhaps, be in design for crash survival) but it is important in aircraft accident investigation work. Materials which 
ordinarily fail in a ductile manner under static loading can be made to fail in a brittle manner if the rate of loading is high 
enough. In this connection the rate of loading has to be appreciably greater than 50 ft per second (15 m/s) for this type 
of loading to be significant. It should be remembered that even when an aircraft strikes the ground at high speed, 
because of elasticity in the aircraft structure and the load-absorbing characteristics of the ground, many parts are loaded 
at rates considerably lower than the actual impact rate. 


Design load criteria 


9.6.9 It is not possible within the confines of this manual to discuss in detail the design load criteria contained in 
the various State regulations on the subject. Nor is it possible to set forth such criteria with respect to the design of all 
aircraft. Whenever an accident occurs in which structural integrity is suspect, the investigator should become familiar 
with the relevant regulations and design criteria. 


9.7 IN-FLIGHT BREAKUP 


Sequence of failure 


9.7.1 In-flight separations are usually the result of metal fatigue, improper design, improper maintenance, or 
aerodynamic loading. And when a structural part or component fails in flight, generally a chain of events is started during 
which other parts or components fail. Thus, when a wing panel fails and detaches itself from the aircraft, very often the 
severed panel will strike and detach portions of the fuselage or tail section. The separation of the wing panel failure is 
generally referred to as the “initial” failure, whereas the fuselage or tail failures are referred to as “subsequent” failures. 
In addition, when the aircraft or its separated components strike the ground, substantial impact damage usually results. 
The investigator's task, then, is first to separate the in-flight damage from the ground impact damage. Next, the 
investigator must search out among the in-flight failures the one initial failure and, finally, must isolate the exact cause 
for this initial failure. 
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9.7.2 In other sections of this chapter, background material has been presented for the investigator's guidance in 
developing pertinent facts relating to structural failure accidents. As the various points are developed, the investigator 
should constantly integrate the new evidence. If the investigation has been proceeding systematically and if the detailed 
examination has been performed with thoroughness, definite modes of failure will become evident. It will be found that 
certain failures must have preceded others for the observed damage to have resulted. As the work progresses further, a 
definite sequence of failure will be established. 


Wing-first sequence 


9.7.3 When the wing fails first due to upward static overload, the separated wing will bend up and back over the 
fuselage. At the same time, the unbalanced lift from the opposite wing causes a rapid roll acceleration with the side of 
the aircraft missing its wing rotating downward. In some instances, the roll rate is rapid enough to cause a torsional 
failure in the empennage. The separated wing often impacts the tail surfaces causing matching impact marks and 
smears between the broken-off wing and the leading edges of the tail. The impact with the tail may be severe enough to 
cause secondary failures in the tail structures (Figures II|-9-16, IIl-9-17 and III-9-18). 


Tail first sequence 


9.7.4 Once aerodynamic forces exceed the strength of the tail, it will usually separate in a downward bending 
fashion. The spars of the horizontal stabilizers will show permanent evidence characteristic of bending failure. The skin 
may also develop diagonal buckling if the leading edge rotates during separation. Once the tail is lost, rapid pitch down 
of the aircraft often results in downward overloading of the wings as a secondary failure. However, the wings may still 
show effects of prior excessive positive loadings (Figures III-9-19 and III-9-20). 


9.7.5 In either case, (wing first or tail first) before the first failure occurred, excessive loads were imposed on the 
airframe. Residual effects of these overload forces can often be found, even after secondary overload separation in the 
opposite direction. For instance, in the first sequence the wing was first exposed to high positive forces until the tail 
failed, causing a negative overload failure of the wing. Such load “reversals” may be mistakenly identified as flutter. The 
investigator must also carefully evaluate the cause of load “reversals” found in other secondary pieces that flap in the 
airstream during the sequential breakup. Such load reversals are not the result of true flutter. 


Aircraft attitude just before failure 


9.7.6 If the investigator follows the procedures outlined throughout this chapter, it should be possible, for 
example, to determine that the left wing panel had failed in flight. However, it still remains for the investigator to 
determine why the wing panel failed and if the failure was consistent with the flight attitude at the instant of failure. This 
kind of determination is necessary in order to rule out the possibility of a design deficiency or to establish the imposition 
of excessive loads. If the accident has been observed by ground or air eyewitnesses, no great amount of work may be 
necessary to reconcile the structural damage to the flight attitude. When witnesses are not available, the investigator 
must compare the failure loading with known loadings for various flight attitudes to arrive at some indication of the speed 
of the aircraft and the manoeuvre being performed at the time of breakup. 
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Figure Ill-9-16. In ahigh speed manoeuvre, the wings are loaded to high positive g 
and the tail to high negative G. 





Figure Ill-9-17. The wing fails due to excessive upward loading and the aircraft rolls abruptly. 
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Figure Ill-9-18. The separated wing often strikes the tail causing secondary failures and/or smears. 





Figure Ill-9-19. The high down loading on the tail causes downward tail failure. 
The loss of tail balancing load causes a rapid pitch-over and down loading on the wing. 
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Figure Ill-9-20. The excessive down load on the wings causes one (or both) wings to fail by down bending. 


Primary and secondary failures 


9.7.7 In determining the sequence of failure, it is extremely helpful to have a thorough understanding of primary 
and secondary-type failures. A primary-type failure is one which occurs while adjacent or associated parts are intact and 
when a loading similar to the design loading has been applied to the failed piece. Thus, a primary-type failure of one of 
the wing main spars would involve the compression failure of one spar chord, and/or buckling of the spar web, and/or 
the tension failure of the other spar chord. A secondary-type failure is one which occurs when the integrity of adjacent 
parts has been destroyed by previous failures. In general, the loading which produces such failure differs from the 
design loading in type. Thus, if both spar chords of a wing spar are found failed by twisting or bending forces, the failures 
would be secondary. Some knowledge of the design functions of the various aircraft structural parts is necessary to 
make determinations of this type. In general, primary-type failures are usually associated with the initial and subsequent 
in-flight failures, while secondary-type failures are more frequently associated with ground impact failures or damage. 
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9.8 COMPOSITE MATERIALS‘ 


9.8.1 Composites” have been used in aircraft for decades. The military has increasingly relied on composites for 
over 40 years. The Windecker Eagle, the first all-composite aircraft certified by the U.S. Federal Aviation Administration, 
received its type certificate in 1969. Home-built composite aircraft have been available to the kit-plane community for 
over 20 years. Even an all-composite spacecraft, SpaceShipOne, has flown into space with repeated success. During 
this long history, however, composites have had limited use in commercial aircraft, primarily in control surfaces, 
secondary structures, and non-structural panels. 


9.8.2 Commercial jet aircraft coming to market in the new millennium represent a significant departure from 
historical trends. These aircraft use composites for primary structures and, in some cases, for nearly 100 per cent of the 
airframe. For example, the Airbus A380 entered commercial service in 2007 with an airframe that is approximately 25 
per cent composite structure by weight, including an all-composite central wing box. The airframe of the Boeing 787, 
scheduled to enter service in 2008, is designed to be approximately 50 per cent composite structure by weight, with 
nearly 100 per cent of the skin, entire sections of the fuselage with integral stiffeners (Figure IIl-9-21), and the wing 
boxes constructed of composites. Powering the Boeing 787 will be the GEnx turbofan engine, with fan blades and 
containment casing made of composites (Figure III-9-21) rather than traditional metals. Complementing this transition in 
the large transport market are the all-composite airframes for business aircraft and very light jets, such as the Adam 
A700 (Figure Ill-9-21), as well as parallel advances with military aircraft. The F-22 contains approximately 60 per cent 
composite structure, compared to slightly more than 20 per cent for the F/A-18C/D, which entered production just a 
decade earlier. Figure II|-9-22 illustrates the growing use of composites in military and commercial aircraft. 


9.8.3 Unlike metals, composites are constructed of multiple distinct materials, typically long fibers that are stiff 
and strong (carbon or glass), and a matrix, which is, essentially, hardened plastic glue that holds the fibers together. The 
glued fibers are assembled layer by layer (each layer is called a ply), to form a laminate. The fibers in each ply either run 
parallel to each other or are woven together in the manner of a textile. The orientation of the fibers is dictated by the 
loads that the laminate is expected to experience, often varying from ply-to-ply in a single laminate. Because of the 
nature of composite construction, and in contrast to metals, the response of composites under loading usually varies 
with the direction in which the load is applied. While designers understand and can predict these phenomena, accident 
investigators must be able to recognize and reconstruct them. 


9.8.4 The analysis of failed composite structures cannot rely solely on the knowledge and experience accrued 
for metallic structures. For example, the physical description of failed composite structures involves terms such as fiber 
pullout, delamination, and interfacial matrix failure. These terms do not even exist in the description of failed metallic 
structures. 


9.8.5 Composites have design variables that are not available in metals. These variables include fiber orientation, 
fiber-to-matrix volume ratio, ply thickness, and ply stacking sequence, among others. With new variables come new 
opportunities for manufacturing errors or imperfections. Some of these imperfections are fiber waviness, poor adhesion 
between fibers and matrix, poor adhesion between plies, excessive voids in the matrix, and an improperly cured matrix, 
among others. 





1. This section is authored by Joseph Rakow, PhD, PE and Alfred Pettinger, PhD, PE of Exponent Failure Analysis Associates. 
Dr. Rakow and Dr. Pettinger are engineers in the Mechanical Engineering and Materials/Metallurgy Practice of the corporation. 
Dr. Rakow can be reached at 650-688-7316 and jrakow@exponent.com; Dr. Pettinger can be reached at 949-341-6004 and 
apettinger@exponent.com. 

2. In this section, “composites” refers to a class of materials characterized by fibers held in a matrix. 


IIl-9-30 Manual of Aircraft Accident and Incident Investigation 








Figure Ill-9-21. Examples of composite structures (clockwise from top): Boeing 787 fuselage, 
General Electric GEnx fan blades and case, Adam Aircraft A700 VLJ. 


9.8.6 Changes in design variables and imperfections directly affect the failure of a composite. For example, 
consider Figure IIl-9-23, in which there are ten composite specimens that have failed under tensile loading.° The ten 
specimens are split into two groups, representing two different ply-wise fiber orientations. Even though all specimens 
failed under tension, the physical appearance of the failures between the groups is dramatically different. In one group, 
the specimens have a shredded appearance, while in the other group the fracture surface is more compact with a 
fibrous texture. This is a result of the difference in fiber orientations between the two groups. Even within each group, 
there are differences in the appearance of the failures, which is the result of imperfections among the five samples of 
each group. With variation in fiber orientations and imperfections, each failed specimen has a unique appearance, even 
though they all failed under tension. This is one of the challenges of analyzing failed composites. In many cases, this 
challenge can be addressed by microscopically analyzing the failure surfaces to identify common features that indicate 
failure in tension. 





3. Ginty, C.A. and C.C. Chamis, “Fracture Characteristics of Angleplied Laminates Fabricated from Overaged Graphite/Epoxy 
Prepreg,” Fractography of Modern Engineering Materials: Composites and Metals, STP 948, ASTM, 1987, pp. 101-130. 
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Figure Ill-9-22. The growing use of composites over time in major aircraft programmes 
by per cent of total airframe weight 





Figure Ill-9-23. Tension failure in composites; macroscopically, even simple tension 
can produce fractures with a wide variety of features. Microscopic analysis is paramount. 
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9.8.7 Typical aircraft metals are ductile, while typical aircraft composites are brittle. Ductility allows for the 
permanent bending, twisting, and denting of structures, which essentially records evidence of events in the accident. As 
an example, consider the dents on the leading edges of the aircraft in Figure III-9-24. Not only do the dents indicate the 
aircraft suffered an impact, they also identify the possible size, shape, and energy associated with the impactor(s).4 This 
type of information often helps the accident investigator(s) in determining the sequence of events of the accident. 
According to the National Transportation Safety Board (NTSB), this aircraft collided with a set of power lines on 
approach.° Another example of evidence provided by ductility is the deformation produced by an explosion occurring 
inside a metallic fuselage. The bulging of fuselage panels, the curling of ruptured edges away from the explosion, and 
the stretching and unzipping of panels along rivet lines, all indicate the role of an explosion in an accident. Assessment 
of the specific nature of these indications relies heavily upon the ductility of metal, a property not provided by typical 
aircraft composites. 





Figure Ill-9-24 The ductility of metal structures provides macrostructurally 
visible information regarding an accident. 





4. Wanttaja, R., “Wire Strike!,” http:/Awww.wanttaja.com/avlinks/wire.htm, 1994. 
5. National Transportation Safety Board, Probable Cause SEA95LA024, 1995. 
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9.8.8 With composites, as with metals, the interpretation of fracture surfaces can provide valuable information. 
To interpret fracture surfaces in failed metallic structures, investigators rely upon a well established and widely used 
body of knowledge, which, in the past, has often provided rapid and insightful results. One example is the crash of 
Chalks Ocean Airways Flight 101 in December 2005 off the coast of Miami, FL. Initial evidence indicated that the right 
wing had separated in flight. Within days, the NTSB had identified fatigue damage in metallic structural components in 
the right wing (Figure III-9-25) with corresponding damage in the structure of the left wing.® As shown in Figure III-9-25, 
an unaided visual inspection of the wing spar cap reveals beach marks, which is evidence widely accepted to indicate 
fatigue failure. As a result of this established analysis, the wing spar cap was identified within days of the accident as a 
critical component in the investigation. 
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Figure Ill-9-25. Indications of fatigue cracking in the lower right wing spar cap of the Chalks Ocean Airways 
Grumman Mallard G73 that crashed in December 2005. This is an example of using accumulated knowledge 
and experience with metallic structures to identify possible factors in an accident. 





6. National Transportation Safety Board, NTSB Advisory 051222a, 2005. 
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Laminates 


9.8.9 Laminates are the basic and most common form of composite aircraft structure. Laminates are constructed 
of multiple plies of composite material, wherein each ply contains long fibers held together in matrix material. One of the 
challenges of analyzing laminates is that their response depends on the direction in which the load is applied relative to 
the direction in which the fibers are oriented. To understand this, consider a single ply. A single ply is generally stiffer 
and stronger in the direction of its fibers than in any other direction. As an example, consider the direction of the load to 
be the 0-degree direction. As the angle between the fibers and the direction of the load increases from zero, the strength 
of the ply decreases dramatically’, as shown in Figure III-9-26. The stiffness drops off similarly. Compare this behaviour 
to a sheet of aluminium. The stiffness and strength of a sheet of aluminium are constant, regardless of the direction in 
which the load is applied.® 


9.8.10 The structural behaviour of composites becomes increasingly complex when individual plies are stacked 
on top of each other and fused together to form a laminate. Figure III-9-27 shows the cross section of a laminate, which 
clearly illustrates the ply-wise variation in fiber orientation.’ The fibers in the middle ply run perpendicularly to the plane 
of the cross section, as indicated by their circular cross sections. The fibers in the other plies run at some angle between 
0 and 90 degrees relative to the plane of the cross section, as indicated by their oblong cross-sectional shapes. "° The 
structural behaviour of such a laminate is dictated by the orientation and directional dependence of each individual ply."' 
For perspective, typical physical properties of composite and metallic materials are provided in Table III-9-2. 


9.8.11 A single laminate skin can exhibit structural coupling behaviour that is not generally observed in traditional 
materials. For example, certain laminates exhibit what is referred to as bend-stretch or bend-twist coupling. Bend-stretch 
coupling is behaviour in which a laminate subjected to only tensile loading not only stretches but also bends, even 
though there are no bending loads applied. Similarly, in bend-twist coupling, a laminate subjected to only a bending load 
not only bends but also twists, even though there are no twisting/torsional loads applied. Such coupling behaviour is 
eliminated only if the laminate is symmetric, meaning the orientations of the fibers in the plies above the geometric mid- 
plane of the laminate are a mirror image of the fiber orientations in plies below the mid-plane. An example of a 
symmetric laminate is one with four plies in which the plies have equal thickness with the following orientations, from 
bottom to top: 90°, 0°, 0°, and 90°. A symmetric laminate will exhibit neither bend-stretch nor bend-twist coupling. 


9.8.12 Unbalanced laminates exhibit different coupling behaviour known as shear coupling. A balanced laminate 
is one in which there is one ply oriented at +6 for every ply oriented at —6. An example of an unbalanced, symmetric 
laminate is one with the following orientations, from bottom to top: 45°, 22°, 22°, and 45°. An unbalanced, symmetric 
laminate subjected to only tensile loading will not only stretch but will also shear in-plane, even though there are no 
shearing loads applied. 


9.8.13 Some laminates do not exhibit the directional dependence discussed earlier. These are called quasi- 
isotropic laminates. Isotropic is a term that describes material behaviour that has no directional dependence. Quasi- 
isotropic laminates are isotropic in the plane of the laminate, meaning that the structural behaviour of the laminate does 
not depend on the direction in which the load is applied, as long as the load is applied in the plane of the laminate. To be 
quasi-isotropic, the plies in the laminate must be oriented at 0°, +45°, -45°, and 90°, or at 0°, +60°, and —60°, with an 
equal number of plies in each orientation. The stacking sequence does not matter. 





7. Hoskin, B.C. and A.A. Baker, Composite Materials for Aircraft Structures, American Institute of Aeronautics and Astronautics, 
1986. 

8. Various manufacturing processes, such as rolling, can create relatively minor directional variations in stiffness and strength. 

9.  Petrak, D.R., “Ceramic Matrices,” ASM Handbook, Volume 21: Composites, ASM International, 2001, pp. 160-163. 

10. The shape of the fiber cross sections can be used to determine the nominal fiber orientation in the plies. 

11. In addition to the unidirectional plies discussed here, laminates frequently have plies with bidirectional fiber orientations, in which 
woven fibers run perpendicular to each other. 
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Table Ill-9-2. Representative properties of typical aircraft composites and metallic alloys 





Glass fibers' 

Tensile stiffness 

Tensile strength 

Diameter 

Carbon fibers” 

Tensile stiffness 

Tensile strength 

Diameter 

Advanced epoxy matrices 
Tensile stiffness 

Tensile strength 

Maximum operating temperature® 
Carbon/epoxy laminates“ 
Tensile stiffness, longitudinal 
Tensile stiffness, transverse 
Tensile strength, longitudinal 
Tensile strength, transverse 
Glass/epoxy laminates° 
Tensile stiffness, longitudinal 
Tensile stiffness, transverse 
Tensile strength, longitudinal 
Tensile strength, transverse 
Aircraft-grade aluminium® 
Tensile stiffness 

Tensile strength 
Aircraft-grade steel’ 
Tensile stiffness 

Tensile strength 


72 GPa 
4.6 GPa 
12 um 


200 GPa 
2.6 GPa 
8 um 


3.5 GPa 
60 GPa 
90 — 250°C 


130 GPa 
7 GPa 
1.1 GPa 
0.02 GPa 


40 GPa 
8 GPa 
1.1 GPa 
0.03 GPa 


69 GPa 
310 MPa 


205 GPa 
700 MPa 





Notes.— These properties are only representative values, many of which have a wide range 
associated with them. MIL-HNDBK-17-1F"? and reference material from manufacturers should be 
consulted for more specific information and properties. Most of the data regarding composite 


materials were taken from Hoskin and Baker’. 

1 S-glass 

2 Graphite Type II 

3 Depends strongly on heat treatment 
during cure process 





NOOA 


Unidirectional, 60% volume fraction 
Unidirectional, 45% volume fraction 
6061-T6 aluminium 

4130 steel, strength depends strongly on 
heat treatment 


12. MIL-HNDBK-17-1F, US Department of Defense, Washington, DC, 2002. 
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Figure Ill-9-26. The strength of a single unidirectional composite ply, based on the angle between the fibers 
and the loading direction, where o;" is the measured ultimate strength of the laminate along the fiber direction, 
62" is the measured ultimate strength of the laminate perpendicular to the fiber direction, 
and t’ is the measured ultimate shear strength of the laminate. 
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9.8.14 Because the plies in a laminate are fused together, the deformation in one ply both influences and is 
influenced by the deformation in neighboring plies; the plies must deform by the same amount at the interface. However, 
because the plies are not all oriented in the same direction, they do not have the same stiffness in the direction of the 
applied force, and therefore the stress in the laminate varies from ply to ply. In particular, the ply with the highest 
stiffness in the direction of the load will experience the highest stress. In addition to the stress, the physical strength of 
each ply varies based on the orientation of the fibers with respect to the direction of loading’, as shown in Figure III-9-26. 
These ply-wise variations in stress and strength can dictate the origin of failure in a laminate. It is important for accident 
investigators to be able to identify how the laminate composition will affect its failure. 


9.8.15 New laminates are constantly being developed, and therefore present new challenges for the investigator. 
Thus, this section cannot address all of the possible failures in composites. For example, one relatively new class of 
laminates is normally referred to as fiber-metal laminates (FMLs). FMLs are similar to the laminates discussed 
previously, but they have plies of metal, typically aluminium, in addition to plies of composite. One example of an FML is 
called GLARE, which has plies of glass/epoxy composite alternating with plies of aluminium. GLARE is used in sections 
of the fuselage of the A380 aircraft. 


Failure features 


9.8.16 The following discussion illustrates features that laminates typically exhibit when they fail under basic 
loading conditions: tension, compression, bending, impact, and fatigue. Because laminates are often components in 
other common forms of composite structures, such as sandwich structures, joints, and repairs, the failure features 
described will be applicable to the remainder of this discussion regarding composites. 


9.8.17 Tension. Figure IIl-9-23 shows how even simple tension can produce a variety of failure features. Despite 
this variety, there are some common characteristics of tensile fractures in fibrous composites that help identify their 
failure under tensile loads. One characteristic is that the fracture surface generally has a rough appearance. For 
example, Figure III-9-28 shows a microscopic view of the fracture surface of a composite that failed under tensile load, 
with the fibers aligned in the direction of the load.'* One clear characteristic of the fracture surface is that fractured fibers 
are sticking out of the fractured matrix, contributing to the rough appearance of the fracture surface. This characteristic is 
called fiber pullout and is a typical indication of tension failure in composites. Fiber pullout is the result of a fiber breaking 
and being extracted from the matrix. Close inspection of Figure III-9-28 reveals, in addition to pulled-out fibers, holes in 
the matrix that were created by other pulled-out fibers. In some cases of tensile failure, some fibers do not fracture but 
the matrix does. The fibers then span the matrix fracture in a phenomenon called fiber bridging. 


9.8.18 In either case, the pulled-out fibers can be used to identify tensile loading, and in the case of stacked 
laminates, to identify those plies that have been loaded in tension. The length of the pulled-out fibers can provide 
perspective on important fundamental conditions present in the composite at the time of fracture, such as temperature 
and exposure to moisture. 


9.8.19 As long, thin members, the fibers are designed to carry tensile loads. However, in the common case of 
composites with ply-wise variations in fiber orientation, tension loads do not run parallel to the fibers, and failure can 
occur in the matrix. Common matrix failures associated with such loading conditions are tension failures between fibers, 
particularly at the fiber-matrix interface, and shear failures in the matrix-rich region between plies, typically associated 
with rough features on the fracture surface called hackles. Such inter-ply shear failures can also be produced under 
compression. 





13. Friedrich, K. and J. Karger-Kocsis, “Fractography of Unfilled and Short Fiber Filled Semi-Crystalline Thermoplastics,” Fractography 
of Polymers and Composites, A.C. Roulin-Moloney (ed), Elsevier Applied Sci. Publ., London, 1989, pp. 437-494. 
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Figure Ill-9-27. Laminate cross-section indicating the ply-wise variation in fiber orientation 
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Figure IIl-9-28. Example of fiber pullout as a result of tensile loads 
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9.8.20 Compression. Under compression, the fibers are less effective than in tension, since the relatively weak 
matrix is required to stabilize the fibers against buckling. One common characteristic of the compressive failure of fibrous 
composites is the formation of kink bands'* as shown in Figure III-9-29. Kink bands are a result of structural instability, 
much like a person standing on and eventually crushing a soda can. The fibers buckle as the compressive load 
approaches a critical level, which is a function of material, geometric, and environmental factors. Fiber buckling can also 
be identified by examination of the fiber ends. As shown in Figure III-9-30, chop marks indicate fibers that have buckled 
and bent to the point of failure."° The chop marks coincide with the neutral axis of the fiber in bending, separating the 
tension side of the fiber from the compression side of the fiber. 


9.8.21 Often associated with kink bands is matrix splitting, which can be seen in Figure III-9-29 as gaps in the 
matrix. Matrix splitting occurs at weak points in the matrix or at areas of high stress concentration, such as at the fiber- 
matrix interface and the interface between plies. Matrix splitting at the interface between plies is referred to as 
delamination, and is discussed further in the paragraphs regarding impact. 


9.8.22 Bending. The difference between tensile and compressive fracture surfaces is readily demonstrated in 
composites that have failed in bending”® (Figure II|-9-31). Divided by a neutral bending axis, one part of the fracture 
surface contains pulled-out fibers, and the other part is relatively flat. This is a result of the fact that, in bending, one part 
of the cross section is in tension and the other part is in compression. These characteristics can readily translate to a 
macroscopic level. Figure IIl-9-32 shows a composite aircraft wing that reportedly failed in bending. "” The bottom 
surface of the wing, which was subjected to tension in bending, has a very fibrous texture relative to the top side of the 
wing, which was subjected to compression in bending. 


9.8.23 Impact. As discussed previously, typical aircraft composites are brittle rather than ductile. Ductile metal 
structures undergo relatively high levels of permanent deformation prior to final failure and this deformation provides 
information regarding the loading leading up to the structural failure. As brittle structures, composites exhibit relatively 
little to no permanent deformation prior to final failure. The metallic aircraft discussed and shown in Figure III-9-24 
provides a clear indication of impact by a foreign object. Impact evidence may not be observed as readily in a composite 
structure. 


9.8.24 Impact loading can cause damage to a composite without producing any visible evidence on the external 
surface of the composite. Consider an aircraft mechanic dropping a wrench on the top surface of a wing. If the wing is 
made of aluminium, the impact may create a dent, essentially recording the impact. The significance of the resultant 
damage can generally be assessed visually. If the wing skin is a composite laminate, however, the impact of the wrench 
may not produce any visually detectable damage on the surface at all, but may instead cause a subsurface delamination 
which is not detectable during any visual inspection. A delamination is a split between plies in a composite, and is a 
common type of subsurface damage. The split can propagate along the interface at which neighbouring plies were 
joined during manufacturing, or it can propagate along the fiber-matrix interface. Figure IIl-9-33 shows two views of the 
cross section of a composite plate after impact. ‘8 As indicated in Figure IIl-9-33, the impact caused extensive 
delamination among multiple plies. Such damage can dramatically degrade the load-bearing capability of the composite, 
even though the fibers may remain intact. Moreover, the damage, if unnoticed, can continue to propagate with further 
loading of the composite. 





14. Bolick, R.L., A.D. Kelkar, and R. Mohan, “Performance Evaluation of Z-pinned Carbon Composites under Tension-Compression 
Fatigue Loading,” Aerospace Testing Expo, 2006. 

15. Stumpff, P.L., “Fractography,” ASM Handbook, Volume 21: Composites, ASM International, 2001, pp. 977-987. 

16. Beaumont, P.W.R. and J.M. Schultz, Failure Analysis of Composite Materials, Delaware Composites Design Encyclopedia, Vol. 4, 
1990. 

17. Stumpff, P.L., “Visual Analysis, Nondestructive Testing, and Destructive Testing,” ASM Handbook, Volume 21: Composites, ASM 
International, 2001, pp. 958-963. 

18. Bascom, W.D., and S.Y. Gweon, “Fractography and Failure Mechanisms of Carbon Fiber-Reinforced Composite Materials,” 
Fractography and Failure Mechanisms of Polymers and Composites, Elsevier, 1989. 
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Figure IIl-9-30. Chop marks can be produced on the ends of broken fibers that have 
buckled and failed under compressive loads. 
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Figure IIl-9-31. Composite specimen that failed in bending. The relatively rough area of tension 
failure and the relatively smooth area of compression failure are clearly identifiable. 
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Figure Ill-9-32. Composite wing that reportedly failed in bending. The relatively rough area of 
tension failure with significant fiber pullout and the relatively smooth area of compression 
failure are clearly identifiable. 





Figure Ill-9-33. Example of composite failure involving delamination 
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9.8.25 Without visible evidence on the surface, delaminations must be identified by cross sectioning the 
composite in the location of the delamination, or by employing nondestructive techniques such as ultrasonic imaging, 
radiography, or thermography. If destructive techniques are employed, delaminations may be identified visually on the 
subsurface by a dull, whitish appearance, relative to the shiny, black appearance of neighboring areas free from 
delamination. 


9.8.26 Fatigue. One of the attractive qualities of composites is that they generally provide better fatigue 
performance than the same structural weight of typical aircraft metals such as aluminium. Despite this fact, composites 
can fail under fatigue loading, and such failures can produce particular failure features. 


9.8.27 Fatigue failure in metals can in some cases be identified by an unassisted visual inspection. '° A typical 
fatigue failure in metals will produce a fracture surface with beach marks, as shown in Figure Ill-9-25. Fatigue fracture 
surfaces in composites, on the other hand, typically do not exhibit visible beach marks. In fact, fatigue fractures in 
composites often appear similar to a corresponding overload failure. 


9.8.28 While fatigue fractures in composite laminates lack macroscopic evidence, some evidence may still be 
identified microscopically. Figure IIl-9-34 shows striations observed at the fiber-matrix interface of a composite. One 
striation typically corresponds to one load cycle."° Although these striations indicate fatigue failure, areas containing 
striations are typically small in size, few in number, and may be dispersed over multiple locations in the composite. In 
addition, the striations are often identifiable only under high magnification and oblique lighting (Figure IIl-9-34 was 
captured under a magnification of 2 000x)."° In summary, identifying fatigue failure in composites can be very 
challenging, and fatigue is not generally identifiable in the field.”° 


American Airlines Flight 587 


9.8.29 The crash of American Airlines Flight 587 in November 2001 provides an illustrative example of the 
principles discussed before. The vertical stabilizer of the A300-600 involved in this accident is the largest composite 
principal structural element in commercial aviation to have failed in service. 


9.8.30 Although the vertical stabilizer on Airbus A300 and A310 series aircraft was originally designed with 
metallic materials, the metallic design was replaced in the mid-1980s by a composite design employing carbon fibers in 
an epoxy matrix. Between the time of its original design and the failure on Flight 587, composite vertical stabilizers had 
been in service for more than 20 years. 


9.8.31 The composite vertical stabilizer of the A300-600 was designed to retrofit aircraft metal stabilizers, and 
therefore is attached to the fuselage through the same method as that used for the metal structure. Three pairs of 
composite lugs (forward, middle, and aft) along the union between the stabilizer and the fuselage, transfer bending and 
vertical loads through large diameter bolts. Between each pair of lugs is a composite transverse load fitting that transfers 
lateral and torsional loads from the stabilizer to the fuselage. 


9.8.32 Analysis of flight recorder data by the NTSB indicated that the aircraft was subjected to an increasing 
oscillatory sideslip motion, eventually causing loads in excess of the ultimate design load of the stabilizer. The NTSB 
determined that the right rear lug of the stabilizer suffered a tensile overload failure that caused the progressive failure of 
the remainder of the attachment points.”" 





19. A detailed visual investigation of the fracture surface at higher magnification with various means is prudent, to confirm the initial 
finding. 

20. One macroscopic feature that may provide evidence of fatigue is abrasion between mating fracture surfaces. With repeated 
loading, the growing fracture surfaces may rub against each other and leave abrasive marks on the ends of broken fibers and in 
the matrix. 

21. National Transportation Safety Board, “In-Flight Separation of Vertical Stabilizer,” AAR-04/04, 2004. 
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Figure Ill-9-34. Striations at the interface between fibers and matrix 


9.8.33 As previously discussed, tensile failures in composites generally produce rough fracture surfaces. 
Figure III-9-35 shows the fracture surface of the right aft composite lug.” The rough appearance of this fracture surface 
helped the NTSB determine that the lug failed under tensile loads. Similar rough fracture surfaces were found on the 
other two lugs on the right side of the stabilizer. As a result, the NTSB concluded that the lugs on the right side of the 
stabilizer failed due to overstress under tensile loading. 


9.8.34 According to the analysis by the NTSB, after the lugs on the right side failed, the damaged stabilizer 
deflected from right to left, loading the lugs on the left side of the stabilizer in bending. In bending, tension developed on 
the inboard side of the lugs and compression developed on the outboard side of the lugs. The NTSB identified evidence 
consistent with tension failure on the inboard side and compression failure on the outboard side of the lugs on the left 
side of the stabilizer. This is consistent with failure in bending, as discussed previously. An example of the evidence 
associated with compression failure is presented in Figure III-9-36, which shows chop marks found on the left aft lug.2” 
As discussed earlier, when fibers are subjected to compressive loads, they can buckle and the fracture surface on the 
end of a failed fiber may indicate chop marks. The left aft, left center, and left forward lugs of the failed stabilizer each 
contained fractured fibers with chop marks. Also found on the left aft lug were hackles associated with shear failure in 
the matrix-rich region between plies (Figure Ill-9-37) as previously discussed.” Hackles were found on the left forward 
lug as well. 





22. National Transportation Safety Board, “Materials Laboratory Factual Reports 02-077 and 02-083,” 2002. 
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9.8.35 Evidence consistent with bending was also found in the aft transverse fitting. Fractures on the attachment 
points on the right side of the transverse fitting were rough in appearance, indicating tensile failure, while the fracture on 
the left-most attachment point had a relatively smooth appearance, indicating compressive failure. This evidence was 
found by the NTSB to be consistent with bending of the stabilizer from right to left. Finally, it must be noted that the 
NTSB did not find any indication of fatigue damage in the vertical stabilizer. 





Figure Ill-9-35. Similar to several other fractures, the fractures of the right aft lug 
were rough, consistent with tensile loading. 
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Figure IIl-9-36. Fractures in multiple locations exhibited chop marks (marked with a “c”) 
on the ends of fractured fibers, consistent with compressive loading and buckling of fibers. 
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Figure Ill-9-37. Interlaminar fractures in multiple locations exhibited hackles, 
consistent with failure in shear. 


Sandwich structures 


9.8.36 A typical aircraft sandwich structure consists of two relatively thin laminates, called face sheets, adhesively 
bonded to opposite sides of a thick lightweight core. The face sheets and core can be made of metal composite, wood, 
or paper. A common use for sandwich structures in aircraft is in the control surfaces, where high stiffness at low weight 
is highly desirable. Figure IIl-9-38 shows a sandwich beam with carbon fiber face sheets adhesively bonded to a 
honeycomb core. A close-up image of a portion of the cross section of this beam is shown in Figure III-9-39. 


9.8.37 The purpose of a sandwich structure is to provide high bending stiffness and high bending strength with a 
lightweight structure. When a homogeneous (single-material) beam is bent, the bending stresses along the long axis of 
the beam are largest in magnitude at the top and bottom of the cross section, assuming identical behaviour in tension 
and compression. They are nominally zero at the middle of the cross section. Conversely, the shear stresses in the 
beam are largest in the middle of the cross section and zero at the top and bottom. Panels in bending have similar stress 
conditions. 


9.8.38 Sandwich structures are designed to manage these stresses in a more efficient manner than a single 
material structure. The face sheets of a sandwich are made of material that is stiff and strong along the axis of the beam 
to manage the high axial stresses at the top and bottom, while the core is made of material that is sufficiently strong in 
shear to manage the higher shear stresses in the middle of the beam. 
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Figure IIl-9-38. Sandwich structure with carbon fiber face sheets and a honeycomb core 
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Figure Ill-9-39. A portion of the cross section of the sandwich beam in Figure IIl-9-38 
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9.8.39 The face sheets of aircraft sandwich structures are typically made of carbon or glass fiber laminates, 
depending on the anticipated operating conditions. The two most common core materials are plastic foam and 
honeycomb. Honeycomb can be made of plastic, paper, or metal. In most constructions, the face sheets are bonded to 
the core with structural adhesive film. 


9.8.40 As with other structural components, sandwich structures generally need to be attached to neighbouring 
airframe components such that they will transmit structural loads. Occasionally, fasteners will penetrate the core of the 
structure. In many cases, however, the face sheets are “closed out,” as shown in Figure III-9-40, to form a thick laminate 
suitable for mechanical or adhesive attachments.”° 


Failure features 


9.8.41 Failures in sandwich structures can involve failure of the face sheets, failure of the core, failure of the 
adhesive bond, or any combination thereof. The failure features discussed in the laminate section above can help an 
investigator analyze a large number of sandwich failures. The following discussion identifies these opportunities, and will 
also identify fundamental failure features that are particular to sandwich structures. 


9.8.42 Tension. With sandwich structures generally employed in areas subject to bending loads, tension failures 
in sandwich structures generally develop as part of the more complex loading condition associated with bending. If a 
sandwich structure is exposed to in-plane tension, both face sheets will be in tension, rather than one in tension and one 
in compression, as occurs in bending. With failure of the sandwich structure under these conditions, both face sheets 
would be expected to produce the features discussed earlier regarding tension failure in laminates. These features 
include a generally rough fracture surface, fiber pullout, and fiber bridging. 


9.8.43 Compression. Sandwich structures are also used as compression-loaded members because, for a given 
weight, their high bending stiffness provides high resistance to buckling. For a common example of buckling, consider a 
person standing on an empty soda can. In many cases, the can either immediately or eventually crushes (buckles). 
When the can buckles, the walls of the can bend. The bending stiffness of the walls directly affects the buckling 
resistance of the can. Reinforcement such as with a honeycomb core, can stabilize the walls and dramatically increase 
the buckling resistance of the can. 


fo Tool side tt 





Lag —~ 





Start of ramp 
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@) Fastener centerline bs End of ramp 


Figure Ill-9-40. Close-out of a sandwich structure for attachment purposes 





23. Ward, S.W. and L. Gintert, “Analysis of Sandwich Structures,” ASM Handbook, Volume 21: Composites, ASM International, 2001, 
pp. 308-320. 
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9.8.44 Global buckling is a basic failure mode of sandwich structures. An example of global buckling, in which the 
buckled sandwich structure bends laterally under compressive loads, is depicted, along with other sandwich 
compression failures™*, in Figure IIl-9-41. This bending creates tension in one face sheet and compression in the other. 
Failure under these conditions, as discussed earlier, may produce laminate tension failure features in one face sheet 
and laminate compression features in the other face sheet. 


9.8.45 Other features of compression failure in sandwiches include the buckling of individual face sheets™. This 
can manifest itself in a number of ways, each of which is illustrated in Figure III-9-41. 


A. Face sheets can become locally debonded and bend away from the core. Buckling of the face sheet 
depends on the buckling resistance of the face sheet as well as the strength of the adhesive bond. 


B. Shear crimping, shown in Figure Ill-9-41, appears to be a form of local buckling, but is actually 
dependent on the global properties of the sandwich. Shear crimping is similar to kink bands, which are 
formed by the buckling of fibers in laminates, as discussed earlier. In shear crimping, the core has 
failed in shear, and the face sheets have typically failed in local bending. 


C. Face sheets may exhibit local buckling in the form of dimpling in the face sheets. Failure depends on 
the material in the core, among other features. 


D. Rather than buckling away from the core, one of the face sheets may bend into and locally compress 
the core”° (Figure III-9-42). 


9.8.46 Bending. Bending failures in sandwich structures are best understood by recognizing that bending 
produces tension in one face sheet and compression in the other. As a result, failure of the face sheet in tension will 
typically produce the failure features associated with laminate tension failure (rough fracture surface, fiber pullout, fiber 
bridging, etc.). The face sheet in compression will typically exhibit the failure features associated with laminate 
compression failure (fiber buckling, chop marks, etc.). In addition, the face sheet in compression can also exhibit the 
failure features associated with face-sheet buckling”° discussed previously and shown in Figure III-9-43. 
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Figure Ill-9-41. Compression failures in sandwich beams 





24. Bruhn, E.F., Analysis and Design of Flight Vehicle Structures, Jacobs Publishing, 1973. 

25. Wadee, M.A., “Experimental Evaluation of Interactive Buckle Localization in Compression Sandwich Panels,” J. Sandwich 
Structures and Materials, 1, pp. 230-254, July 1999. 

26. Herakovich, C.T., Mechanics of Fibrous Composites, John Wiley & Sons, 1998. 
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Figure Ill-9-42. Local buckling of a face sheet into the foam core 





Figure IIl-9-43. Example of a sandwich structure with face-sheet buckling leading 
to debonding from the core 
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9.8.47 In addition to tension and compression in the face sheets, bending produces shear loading in the adhesive 
and in the core. It is possible for the adhesive to fail in shear without producing any failure features in the face sheets or 
core. In this case, the face sheet debonds and slides along the surface of the core. 


9.8.48 Impact. Because they are designed for in-plane loads produced by bending, sandwich structures are 
particularly susceptible to impact damage. The thin face sheets and lightweight core can be damaged from even 
relatively low-energy impacts, which may cause crushing in the face sheet and core’’, as shown in Figure III-9-44. 
However, like impact damage in laminates, it is possible for sandwich structures to sustain damage below the surface 
without any visible indication on the surface. This subsurface damage can take the form of delamination in the face 
sheet or crushing in the core, without any damage in the face sheet”’, as shown in Figure III-9-45. Relatively high-energy 
impacts can lead to full penetration through the sandwich panel. 


9.8.49 Fatigue. Fatigue in sandwich structures is possible, but as with laminates, is not as prevalent as in metallic 
structures. If fatigue damage develops, it can produce a number of failure features, depending on which component of 
the structure fails in fatigue. The face sheets, core, and adhesive can all potentially fail in fatigue. If the face sheets fail in 
fatigue, they will typically exhibit the features discussed in the section on laminates. 


Joints 


9.8.50 An aircraft is comprised of various structural components joined together. Past failure experience indicates 
that joints are the most common site for the initiation of failure. Composite structural components are joined by adhesive 
bonding or with mechanical fasteners like bolts and rivets. These joints share several fundamental design considerations 
with the joining techniques of metallic structures; however, some important differences exist that introduce new failure 
modes. Despite this increase in the number of potential failure modes, composite assemblies employ fewer joints than 
metallic assemblies. This is especially evident when comparing the number of mechanically fastened joints in a metal 
structure with that of a composite structure, which typically is a more highly integrated structure.”® 


Adhesively fastened joints 


9.8.51 In their simplest form, adhesively fastened structures consist of two composites (adherends) that are 
bonded with an adhesive or are co-cured (i.e. two uncured composites are cured together, such that the load transfer 
occurs through the now-shared matrix layer). Figure IIl-9-46 gives an overview of the most common types of bonded 
joints. Bonding is a natural joining method for composites, because the adhesive can be chemically similar to the 
composite’s matrix.® Co-curing is a frequently used bonding method that allows the manufacture of highly integrated 
structures with complicated geometry.72:79°0:3" 


9.8.52 When compared to mechanical joints, bonded joints offer the advantages of transferring loads over a large 
area, sealing the joint, and resisting corrosion. However, bonded composite components need to be prepared 
meticulously and carefully aligned to achieve their intended strength. Quality assurance and verification of composites is 
time-consuming and technology intensive. 





27. Federal Aviation Administration, “Impact Damage Characterization and Damage Tolerance of Composite Sandwich Airframe 
Structures,” DOT/FAA/AR-00/44, Washington, DC, January 2001. 

28. Niu, M.C-Y., “Composite Airframe Structures — Practical Design Information and Data,” Conmilit Press Ltd., Hong Kong, 1992. 

29. ASM International, ASM Handbook — Volume 21, Composites, ASM International, 2001. 

30. Dreger, D.R., “Design Guidelines for Joining Advanced Composites,” Machine Design, May 8, 1980, pp. 89-93. 

31. Cosenza, F., “Mechanical Fasteners for Composites,” Materials Engineering, August 1987, pp. 33-37. 
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Figure III-9-45. Crushed core without any visible damage to the face sheet 
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9.8.53 The primary load transfer between the bonded components depicted in Figure II|-9-46 occurs in shear via 
the adhesive layer.”® Figure IIIl-9-47 illustrates the non-uniform shear stress distribution of a balanced* double-sided 
joint with larger shear stresses at the edges.*? When the load increases further, the adhesive will deform plastically at 
the edges towards the inside to sustain this load level. Similar trough-like shear stress distributions are found for single- 
lap joints. However, in the case of single-lap joints, the axial tension loads in the adherends are not aligned with each 
other. This produces a bending moment at the joint. The induced-peel stresses are largest at the edges, and reduce the 
total load transfer capacity of bonded joints. For symmetrical double-sided joints, the eccentricity in loading does not 
exist, but some peel stresses are still developed along the overlap length. 


Failure features 


9.8.54 Typically, four failure modes are used to categorize the failure of lap joints with three occurring in the 
adherend and one in the adhesive layer. They are illustrated”® in Figure IIl-9-48 for adherends of equal strength. 
Figure IlIl-9-48(a) depicts the delamination of the composite, where peel stresses are pulling the top fiber layer from the 
matrix. This results when the tensile strength of the adhesive is larger than the interlaminar tensile strength of the 
composite. Figure IIl-9-48(b) depicts a failure mode, where in-plane fiber stresses at the joint’s interface are large, 
potentially leading to fiber breakage. Finally, Figure III-9-48(c) depicts an interlaminar failure due to the very high normal 
stresses and peel stresses acting at the stress concentration. The failure modes depicted in Figure Ill-9-48 have also 
been reported to occur in sequence, describing a failure progression from Figure III-9-48(a) to Figure II|-9-48(c). It is 
noted that if one adherend were stiffer, then failure would occur at the edge in the less stiff adherend in the manner 
discussed above.*”*?*# 


9.8.55 Failure of the adhesive layer can be minimized by designing a sufficiently long overlap length that reduces 
shear stresses to allowable levels.*°*° Failure in these layers may produce hackles? as exhibited in Figure III-9-49. 
These hackles form approximately at a 45-degree angle when the loads permanently deform the adhesive’ (Figure III- 
9-49). If the loading is reversed (i.e. changes with time from tension to compression), the hackles’ orientation will be 
flipped, and a sawtooth-like fracture surface will develop.”° In cases where the overlap length is sufficient and the failure 
begins in the middle of the adhesive, a close examination of the adhesive and the bonded surfaces is warranted. 
Investigators should determine the thickness, porosity, and chemical composition of the adhesive layer and evaluate the 
surface preparation, since all of these elements can significantly influence the bonded joints’ load carrying capacity. 





32. Balanced joints have the same extensional stiffness for the adherents. 

33. Hart-Smith, L.J., “Adhesive-Bonded Double-Lap Joints — Technical Report,” Douglas Aircraft Company, Langley Research Center, 
January 1973a. 

34. Hart-Smith, L.J., “Adhesive-Bonded Single-Lap Joints — Technical Report,” Douglas Aircraft Company, Langley Research Center, 
January 1973b. 

35. Hart-Smith, L.J., “Specimen Shows Thickness Where Adhesive Will Not Fail,” Adhesives Age, April 1987, 30(4), pp. 28-32. 
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Figure Ill-9-46. Bonded joints: (a) to (c) are single-lap joints, 
and (d) to (h) are double-lap joints and their variants. 
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Figure Ill-9-47. Shear stress distribution under increasing load for an adhesive 
that is capable of deforming plastically prior to failure 
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Figure Ill-9-48. Potential failure modes of simple bonded lap joints 
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Figure Ill-9-49. Tensile hackle failure of an adhesive layer under 
monotonic shear loading above the allowable elasticity 
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9.8.56 The magnitude of the induced peel stress is significantly affected by joint geometry and careful 
consideration of joint features (tapering, etc.). Figure II|-9-50 illustrates this by showing the distribution of shear stresses 
and peel stresses for a double-strap splice where the left side of the splice plate is tapered and the right side is not.78° 
Several important observations can be made on the distribution of the shear stress and peel stress. The shear transfer 
follows a trough-like distribution for both sides of the splice plate, with both ends of the splice plate’s right side having 
effectively the same maximal shear stress peaks. However, the outer right edge in Figure III-9-50 is the most critical 
failure location, since peel stresses are larger there.”®*° The left edge of the left side of the splice plate experienced a 
reduction of the shear stresses, because of the taper, transferring some of the load further into the splice plate. The 
overlap region is more highly sheared, and peel stresses are compressive at this location. Due to the above described 
stress distribution, failures of balanced and tapered double-lap joints initiate most commonly at the inner edge of the 
joint’s overlap”? (Figure IIl-9-50). Failures of double-lap joints with untapered ends typically begin at the outer edges. 
Unbalanced* double-sided joints experience the highest strain and shear stresses at the least stiff side of the joint, 
causing failure initiation in the weaker adherend.7°°?° 


9.8.57 It is also noteworthy that the strength of the single-lap joint is much more temperature dependent than that 
of a balanced double-sided joint®, because the overall single-lap joint strength is governed by an individual material 
property of the adhesive.*°*° Balanced double-sided joints significantly minimize the temperature dependence of the 
joint, because the adhesive’s load capacity depends on the adhesive’s absorbed strain energy. The strain energy is 
typically not temperature dependent, because with increasing temperatures the adhesive’s shear strength decreases but 
the failure strain increases** (Figure |IIl-9-51). Clearly, this is another benefit of double-sided joints; however, most 
aircraft structures are statically indeterminate, such that strain compatibility constraints limit the joint’s ability to stretch 
and accommodate the imposed loads to the fullest. 


9.8.58 The stepped-lap joint and scarf joint are more efficient high-strength bonded joint designs, which also allow 
smooth surface transition to satisfy aerodynamic requirements (Figure II|-9-46). Optimal scarf joints require very small 
scarf angles of only a few degrees, which are typically not achievable because of manufacturing constraints. 
Armstrong®” noted that scarf joints commonly have a taper of 1 in 50 except at panel edges where a scarf angle of 1 in 
20 is sometimes acceptable. Niu®® reported that failures can occur at the tip of the stiffer laminate. 


9.8.59 The stepped-lap joint is a hybrid joint between a double-sided joint and a scarf joint, in which each step 
behaves like a double-sided joint. The structural complexity of this joint requires a detailed analysis to determine the load 
levels that may have been experienced. The shear stress distribution follows that of a double-sided joint, with peak 
shear stresses at the edge of each step. For this type of connection Niu®® reported that the end step of the interior 
laminate can fail. The stepped-lap joint is typically used in critical, highly loaded applications such as the wing root joint”® 
shown in Figure III-9-52. 


Mechanically fastened joints 


9.8.60 Mechanically fastened composite joints are typically less efficient than their adhesively bonded 
counterparts, because the presence of a hole and fastener introduces additional undesirable stresses that negatively 
affect structural integrity. Forces are introduced over a smaller area than for adhesively bonded components, requiring in 
some cases additional material in the joint members. Mechanically fastened joints are commonly used to join thick 
composite laminates. Also, mechanical fastening is employed in complex joints in which disassembly of the structure is 
desired. In many cases, composite members are bonded to metal fittings and the metal fittings are joined 
mechanically.”® This allows the more localized and multi-axial loads at the joint to be transferred via the metal fittings. 
These fittings are preferably made of stainless steel or titanium alloy. 





36. Unbalanced double-sided joints are joints where the combined stiffness of the two adherend transferring forces in one direction is 
not equal to the stiffness of the adherent in the middle. 
37. Armstrong, K., L. Bevan, and W. Cole, Care and Repair of Advanced Composites, Second Edition, SAE International, 2005. 
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Figure Ill-9-50. Shear stress and peel stress distribution for a double-sided joint 
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Figure Ill-9-51. Effect of temperature on the stress/strain relationship of a ductile adhesive 
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9.8.61 Mechanically fastened joints are also sometimes advantageous in permanent or semi-permanent 
installations when a composite needs to be joined to an un-bondable surface.*' Bolted connections are relatively easy to 
install and inspect, and require little surface preparation in comparison to adhesively bonded structures.°°* Three 
common mechanically fastened joints are the single-lap joint, double-lap joint, and multi-row bolted connection” 
(Figure III-9-53). 

9.8.62 Mechanically fastened composites have several specific failure issues.°°?“° First, composites are brittle, 
which makes them more sensitive to stress concentrations than metals. Second, the interaction of bolts and laminates is 
complicated and dependent on fiber volume, matrix distribution, laminate stacking sequence, and the exact fiber-matrix 
distribution at the hole. All of these considerations have a significant impact on the joint’s failure mode. The joint strength 
of composites is also strongly dependent on the bolt type: pins have the lowest joint efficiency, whereas bolts with 
washers or properly sized heads and adequate pre-torque to prevent brooming of the fibers increase the joint’s load 
capacity.*° 


9.8.63 An important topic with mechanically fastened composites is the behaviour at ultimate load.”® 
Figure IIl-9-54 compares the fastener shear load distribution of a metal joint with four equal rows of fasteners to that of a 
similar composite joint. The fastener load of the metallic joint is uniform across the joint at ultimate load because 
permanent deformation of the plates assists in distributing the fastener loads. Composite joints cannot achieve this 
uniform stress distribution because of their lack of ductility. Consequently, multi-row arrangements are not as common 
for composites structures as for metal structures. 


9.8.64 This behaviour makes multi-row composite joints very sensitive to manufacturing tolerances.*° Holes in 
composites need to be drilled to exact dimensional precision; otherwise one bolt will carry a significantly larger load. In 
the case of metals, this is not as much of a concern because localized permanent deformation quickly compensates for 
this geometric mismatch between fasteners and the metallic component. Fasteners in composite structures must bear 
the full load range and potentially initiate failure. 


9.8.65 Installation of fasteners can also have significant effects on a joint’s failure in service. Interference fit 
fasteners have been shown to increase the life expectancy of the joint by inducing some minor delamination around the 
bolt but not damaging the fibers. The fibers bridge the localized stress concentration, increasing the joint’s life. On the 
other hand, if fibers are damaged during installation or the bolt fits loosely, the joints life is reduced significantly.7°°°*" 


Failure features 


9.8.66 The principal failure modes of mechanically fastened composite joints*? are depicted in Figure IIl-9-55 and 
are as follows: net tension failure through the bolt hole, shear-out failure, bolt pulling through laminate, cleavage-tension 
(transverse tension), bearing failure with localized crushing of the laminate on the back face of the fastener, and bolt 
failure. Net tension and bearing failure are typically the higher strength failure modes of optimally proportioned 
composite joints.2°°°*' The shear-out failure*? (Figure II|-9-55) is typically a lower strength mode than bearing failure and 
if the width of the strip is too small the laminate may also fail in cleavage-tension. 





38. Phillips, J.L., “Fastening Composite Structures with Huck Fasteners — Part 1,” Aircraft Engineering, 58(11), Issue 693, Nov. 1986, 
pp. 2-6. 

39. Hart-Smith, L.J., “Bolted Joints in Graphite-Epoxy Composites,” Douglas Aircraft Company, Inc., National Aeronautics and Space 
Administration, 1976. 

40. Diplomarbeit, “Uberarbeitung und Optimierung der Seastar Héhenleitwerksflosse: Vergleich einer GFK-und CFK Stuktur,” Design 
and Optimization of the Seastar’s Pettinger, A.M., Optimization of the SEASTAR’s Horizontal Stabilizer: A comparison between 
GFRP and CFRP, Diplomarbeit, Fachhochschule Munchen, July 1991. 

41. Hart-Smith, L.J., “Mechanically-Fastened Joints For Advanced Composites — Phenomenological Considerations and Simple 
Analyses,” Douglas Aircraft Company, 4" Conference on Fibrous Composites in Structural Design San Diego, pp. 543-574, 1978. 
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Figure Ill-9-52. Step-lap joint connecting to metal fitting for wing root joint 





Figure Ill-9-53. Several carbon fiber composite reinforced components 
of the A300-600s vertical tail are joined with fasteners in single- and double-row fastener patterns. 
White arrow indicates structural failure. 


Part Ill. Investigation 
Chapter 9. Structures Investigation III-9-61 











(Load distribution) (Load distribution) 
a) Bolt load distribution at ultimate b) Bolt load distribution at ultimate 
load for a metal joint load for a composite joint 


Figure IIl-9-54. Comparison of load distribution at ultimate load: 
a) metal joint and b) composite joint 
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Figure Ill-9-55. Six common bolt failure modes 
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9.8.67 Figure Ill-9-56 shows a net tension failure** of the vertical tail of the A300-600 from American Airlines 
Flight 587. The investigators of the NTSB also detected areas where a bearing failure occurred. In this specific case, the 
composite was reinforced with a metal sleeve. A bearing failure®’ is shown in Figure III-9-57 and a shear-out failure’? is 
shown in Figure III-9-58. 


9.8.68 The failure mode of a mechanically fastened joint depends strongly on the lay-up of the joined members. 
Shear-out failure may occur if the laminate does not have a sufficient proportion of 90-degree fibers. Cleavage failure 
may occur on composites with too few transverse plies and is aggravated by a narrow strip width and short edge 
distances, in which case the failure will begin at the free edge some distance away from the hole®", Nearly quasi- 
isotropic lay-up patterns are used by designers at bolt holes to help avoid shear-out and cleavage failures. An accident 
investigator can benefit from checking the lay-up relative to the design. 


Repairs 


9.8.69 Composite structures may be damaged during manufacturing or in service. As with metal structures, many 
types of damage in composites can be repaired in an effort to restore the integrity of the structure. Subsequently, while 
these repairs are in service, they may become involved in, or possibly directly lead to, a structural failure. In surveying 
post-accident wreckage involving composite structures, the accident investigator must be able to identify the presence of 
repairs and determine whether the repair played a role in the accident. The following discussion is intended to provide 
some assistance to investigators in this effort. Armstrong?” provides further guidance. 


interlaminar crack 





Figure IIl-9-56. Net tension section failure of the right rear lug of the A300-600. 
Unlabelled white arrows indicate bearing damage adjacent to the fracture. 
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Figure Ill-9-57. Extensive bearing failure of carbon composite laboratory specimen 
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= | Ee 


Figure Ill-9-58. Shear-out failure of carbon composite laboratory specimen 
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9.8.70 Composite repairs can be divided into two categories: patches and resin injection. Patches in composite 
structures are similar to patches in clothing — the patch is intended to prevent further propagation of the damage. 
However, in addition to these common functions, patches in composite structures are frequently expected to replicate 
certain functions of the original structure, including load-bearing capabilities and environmental survivability, for the 
remainder of the design life of the structure. As with metal structures, any repair must be carried out in accordance with 
the Manufacturer’s Structural Repair Manual, or with other repair methods approved by the Airworthiness Authorities. If a 
repair is near a pre-accident structural failure, a thorough investigation of the repair’s design should be conducted. 


9.8.71 Typical patches in composite structures are either metal or composite and are either mechanically or 
adhesively fastened to the original structure. Selection of material for the patch, as well as the method of attachment, is 
based on the type of damage and the structural functions to be provided. Typically, metallic patches with mechanical 
fasteners are employed for thick structures that carry substantial loads, while adhesively fastened composite patches 
are employed for thin structures that carry relatively minor loads.*? Despite these trends, not all composite patches are 
fastened adhesively and not all metallic patches are fastened mechanically; mechanically fastened composite patches 
and adhesively fastened metallic patches are also employed on occasion. 


9.8.72 After the damage has been identified and a patch has been selected and designed, the basic procedure 
involved in applying a patch is as follows: 


a) remove the damaged portion of the structure; 
b) fill the void with appropriate filler material; and 
c) bolt or bond the patch to the structure. 


Examples of this procedure are discussed in an effort to illustrate the main components and features of typical repair 
patches. 


9.8.73 Consider a sandwich panel that has been punctured by impact*?, such as the panel shown in Figure III-9- 
59(a). With the face sheet compromised, this type of damage can affect the load-bearing integrity of the sandwich 
structure. For repair, the steps listed above are followed. The damaged portion of the face sheet and honeycomb core is 
removed“, as shown in Figure II|-9-59(b). After removal of the damage, a replacement core plug is inserted**, as shown 
by the dark material at the center of Figure III-9-59(c). Finally, a composite repair patch is bonded into place’, as shown 
in Figure IIl-9-59(d). Subsequent steps will likely include smoothing the edge of the patch and treating and painting the 
surface. Figure II|-9-60 is a schematic of what the cross section of the repair in Figure III-9-59 may look like.“? As can be 
seen, the filler material in the core and the adhesively fastened composite patch are intended to reestablish the 
structural load path through the previously damaged region. 


9.8.74 A repair procedure similar to that just discussed for sandwich structures is employed for composite 
laminates. Figure III-9-61 and Figure Ill-9-62 show two bonded composite repair patches.” In these cases, composite 
plies constitute the filler material and the patch. The smooth, angular interface in Figure IIl-9-61 is called a scarf interface; 
the interface in Figure Ill-9-62 is called a stepped interface.” Scarf interfaces are typically used when relatively high 
loads are to be transferred through the repaired region or when a smooth surface contour is needed.°”** 





42. Hoke, M.J., “Repair Applications, Quality Control, and Inspection,” ASM Handbook, Volume 21: Composites, ASM International, 
2001, pp. 893-898. 

43. Heslehurst, R.B. and M.S. Forte, “Repair Engineering and Design Considerations,” ASM Handbook, Volume 21: Composites, ASM 
International, 2001, pp. 885-892. 
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Figure IIl-9-59. (a) Puncture through the face sheet of a sandwich structure. 
(b) Damaged portion of the structure is removed. (c) Void created by removing the damage is filled. 
(d) Repair patch is bonded to the original structure. 
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Figure Ill-9-60. Adhesively fastened patch repair in a sandwich structure cross-section, 
similar to the repair shown in Figure III-9-59 
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Figure IIIl-9-61. Adhesively bonded patch with a scarf interface in a laminate 
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Figure Ill-9-62. Adhesively bonded patch with a stepped interface in a laminate 
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9.8.75 An example of a repair employing a mechanically fastened metallic patch”? is shown in Figure III-9-63. In 
this example, the damaged composite laminate is the skin of a wing. The damage is removed and a titanium patch is 
attached with fasteners running through the laminate. No structural filler material is used in this case. 


9.8.76 Metallic patches are typically made of aluminium or titanium. Because aluminium in contact with carbon 
can lead to corrosion, titanium patches or surface protection are typically employed for metallic patches in carbon 
composites. Figure II|-9-64 is a schematic of what the cross section of the repair in Figure III-9-63 may look like, with a 
low modulus filler material.“7 As can be seen, the metallic patch is intended to establish a load path around the 
previously damaged region. The split of the backup plate on the undamaged side is typically used to minimize unwanted 
local stiffness changes in the structure. 


9.8.77 Many patches can be identified readily with a visual inspection of the structural surfaces. While 
mechanically fastened patches may be readily identifiable, adhesively fastened patches, particularly those in which there 
is a smooth interface between the edge of the patch and the original structure, may be more difficult to identify. 
Reviewing any documented repair history of the structure can assist in this effort. 


9.8.78 Resin injection is a repair technique in which resin is injected into the composite to fill certain types of 
damage such as fissures, voids, gaps, and delaminations. Resin injection is typically reserved for non-structural or light- 
structural repair, because composites generally obtain most of their strength from their fibers. Resin injection creates 
regions of high resin content without reinforcement. Subsequent structural loading could lead to failure in the resin-rich 
regions. 
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Figure IIl-9-63. Mechanically fastened metallic patch 
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Figure Ill-9-64. Mechanically fastened patch repair cross-section in a laminate, 
similar to the repair shown in Figure III-9-63 
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Figure Ill-9-65. The delamination on the right side is repaired with the resin injection 
procedure demonstrated on the left side. 
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9.8.79 Figure IIl-9-65 shows an example of a resin injection repair.“? As shown on the right side of Figure III-9-65, 
the top face sheet of the sandwich structure contains a delamination. A delamination, as explained previously in this 
discussion, is a separation associated with a loss of bonding between neighbouring laminate plies. For the 
delaminations in Figure IIl-9-65, resin injection is being used to fill the void and bond the delaminated layers. Once the 
delaminated region is identified“, resin is injected through an injection hole in the laminate. The resin is intended to flow 
between the injection hole and a series of vent holes near the boundary of the delaminated region. 


9.8.80 Resin injection repairs can be challenging to identify because any markings left on the surface are typically 
sanded and painted to restore an even surface finish. A review of any documented repair history of the structure can be 
helpful in identifying the location of past repairs. In addition, radiography and cross sectioning of laminates can help 
identify resin-rich regions created by the repairs. 


Failure features 


9.8.81 Like any other structural element, repairs are susceptible to failure in service. Inadequate design, errors in 
manufacturing and installation, and unexpected service conditions can cause a repair to fail, which, in turn, can cause 
the surrounding structure to fail. Potential failure modes in patches are strongly dependent on the method of attachment, 
adhesive or mechanical. Examples of some of these failure modes are listed in Table III-9-3. The above discussion on 
adhesive and mechanical joints can provide significant guidance regarding the investigation of failures in adhesively and 
mechanically fastened patches. 


Table Ill-9-3. Examples of failure modes in adhesively and mechanically fastened repairs 








Adhesively fastened Mechanically fastened 

Degradation due to temperature Holes weaken surrounding structure 

Degradation due to humidity Holes provide stress concentrations 

Poor surface preparation Poor surface quality in finished holes 

Improper curing of adhesive Galvanic corrosion 

Curing degrades surrounding structure Poor geometric fit between original structure and 


Poor geometric fit between original structure and repair elements 
repair elements 





9.8.82 Adhesively fastened patches have a few qualities that can potentially contribute to failure. One quality is 
the bond created during installation of the patch. Surface preparation is critical to ensuring an adequate bond. The 
surface must be clean and sufficiently rough. In addition, the bond should be full and complete, with no voids or wrinkles 
across the interface between the adhesive and the adherends. In analyzing a failure involving an adhesive patch, 
examination of the contact surfaces between the adhesive and the adherend can reveal some of these errors. Debris on 
the interface can indicate that the adherends were not cleaned prior to bonding. Particularly smooth or particularly rough 
surfaces on the adhesive and adherends can indicate that the roughness of the adherends was not adjusted 
appropriately prior to bonding. Abrupt changes in the appearance of the adhesive surface can indicate the presence of 
wrinkles or voids that created a local area without bonding. 





44. ldentification can be done by a coin tap test or nondestructive inspection (NDI) such as ultrasonic techniques. More information on 
NDI can be found in most of the references contained in this section of the manual. 
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9.8.83 Another quality of adhesively fastened repairs that makes them susceptible to failure is the curing process 
of the adhesive. Typically, structural adhesives require specific temperature and pressure schedules to cure fully. As 
with any critical process, failure to follow the specified procedure could lead to failure. A less obvious cause of failure is 
the possibility that the curing process could degrade the mechanical properties of the adherends. For example, 
thermoset materials typically have a lower cure temperature than thermoplastic materials. If a thermoplastic adhesive is 
used to repair thermoset adherends, curing of the adhesively bonded patch could degrade the thermoset adherends and 
lead to failure. One way to identify this failure mode is to test the mechanical properties of the adherends near the 
bondline, relative to their properties away from the bondline. The curing process can also lead to moisture-related 
failures in the bond. The heat and pressure of the process can cause moisture to be released from the adherends and 
settle along the bondline, weakening the bond and leading to failure. An analysis of the moisture content of the 
adherends near the bondline relative to the content away from the bondline may identify this failure mode. 


9.8.84 Mechanically fastened patches have a few qualities that can potentially contribute to failure. First, the holes 
drilled to accommodate the fasteners can weaken the original structure in a number of ways. Drilling the holes removes 
material, creates stress concentrations, and creates new surfaces that may have defects. As with metals, free surfaces 
in composites provide opportunities for imperfections, such as notches or microcracks, which can grow with continued 
loading. In laminates, free surfaces provide an additional hazard because they are particularly susceptible to 
delamination. In addition, the interaction of loads and geometry throughout fastened joints can be significantly more 
complex than they were in the original structure. Specifically, the structure may not be optimized to carry bolt loads and 
as such may be more susceptible to the previously discussed failure modes of bolted composite joints. 


9.8.85 Resin injection repairs can contribute to subsequent failures. By the nature of the technique, resin injection 
creates a region of high resin content. Because the matrix in a typical composite is relatively weak and compliant 
compared to the fibers, a resin-rich region can provide a site for failure initiation. A visual examination of the fracture 
surfaces of a broken structure can help identify resin-rich regions. Resin-rich regions associated with resin injection 
repairs can be identified by locating the injection hole or by examining the structure around the resin. Typically, 
deformed laminate plies or misaligned fibers, remaining from the original damage, will be found adjacent to the injected 
resin. Resin-rich regions, particularly between plies, are susceptible to failure in shear, which can be indicated by 
hackles, as discussed earlier and shown in Figure III-9-37. 


9.9 SPECIALIST EXAMINATIONS 


9.9.1 In addition to examinations of composite specimens, some of the more frequently conducted laboratory 
tests are (1) tests on metallic parts for evidence of fatigue cracking, poor welding, substandard material properties, poor 
heat treatment, stress corrosion cracking, inadequate dimensional properties, etc., and (2) tests on smears, scores, cuts, 
etc., to determine such things as the nature of the substance and the direction of applied forces. 


9.9.2 Once the sample has been received in the laboratory, a variety of tests can be accomplished as 
appropriate. Microscopic examination, heat, and loading experiments assist in the definition of causation with respect to 
structural failure. It is possible through such testing to identify fatigue or corrosion cracking, inadequate welding, poor 
heat treatment, substandard material properties, inadequate dimensional properties, etc. Likewise chemical analyses 
can be employed effectively on material samples and are particularly useful in the identification of smears. 


9.9.3 Tests are frequently performed in relation to the strength of the aircraft structure and this involves testing of 
structural loads through the medium of strain gauges appropriately placed for either flight testing or static testing on the 
ground. Testing of possible system errors by means of various recording devices may also be considered. 
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9.9.4 Where damage is suspected to be the result of unusual circumstances, such as the detonation of an 
explosive device, many samples of debris — dust, cushion, furnishing, smears, pieces of paper, wires, etc. will be 
necessary. The smallest item of a suspicious nature or appearance should not be neglected. All parts or items should be 
carefully sealed in clean containers, fully labelled and dated. 


9.10 FRACTOGRAPHY 


General 


9.10.1 Examination and analysis of the actual fracture faces, known as fractographic analysis or more commonly 
fractography, will normally enable the investigator to identify the mode and cause of failure. This technique relies for its 
success on the fact that precise identification of the macro and microscopic topography of the fracture surfaces can be 
used to positively identify the mode of fracture (overload, fatigue, stress corrosion, etc.). Having identified the mode of 
failure, analysis of the loading, geometry, deformation, environment and so forth can lead to deduction of the cause and 
sequence of failure. 


Initial examination 


9.10.2 Initial examination by eye alone can sometimes give a sufficiently accurate analysis to identify the cause of 
failure if the failed component is large enough. However, it is more normal for the investigator in the field to use a pocket 
magnifying glass of perhaps 10x magnification power. This tool (together with a macro-closeup camera for permanent 
recording of the details) will usually enable the field investigator to identify and select failed components suspected of 
being a primary cause of the accident. 


Laboratory examination 
Stereomicroscope 


9.10.3 To obtain more precise analysis the suspect components would be forwarded to a laboratory, or at least 
the investigator's office, for closer examination. A good optical stereomicroscope will allow macro-examination to 
typically 50x life size, and will also allow full colour photography of the revealed details. The availability of colour is often 
of particular importance in recording details of corrosion products and/or paint chips and smears associated with fracture 
faces. 


Scanning electron microscope (SEM) 


9.10.4 For many engineering metals, positive analysis of the fracture mode requires examination of the micro- 
topography (the shape of the surface of the fracture across 1/1 000th of a centimeter rather than across centimeters). 
Laboratory quality optical microscopes are capable of examination of flat surfaces up to 2-3 000x life size (this capability 
is extensively used for example in metallography, where the investigator is examining a polished and etched flat section 
cut from the component to identify its structure, and can hence derive its method of manufacture and heat treatment, 
and possible subsequent environmental exposure). Unfortunately, fractures are seldom flat, and as the magnification is 
increased the depth of field is reduced. As a result, at 1 000x life size, practically all of the fracture surface will be out of 
focus and hence no true analysis and understanding of the fractography can be derived. 


Ill-9-72 Manual of Aircraft Accident and Incident Investigation 





9.10.5 This problem can usually be resolved by use of the scanning electron microscope (SEM). The SEM 
examines the sample under a vacuum, but this is not normally a problem for inorganic (dead) samples. It operates by 
scanning a fine electron beam across the sample, and picking up resulting electrons ejected from the surface. The 
resulting signal is used to modulate the brightness of a beam creating a T.V. image scanning at the same rate as the 
sample scanning beam. The observed picture is quite similar in appearance to an optical image, but has a depth of field 
relatively 300x to 500x as great as the optical image at similar magnifications. In theory the magnification can be 
increased indefinitely, as it is merely the ratio of the output T.V. screen area compared to the area being scanned on the 
sample. Since the area scanned on the sample can be reduced to very small levels, in practice SEM examinations can 
cover the range from perhaps 5x life size to 50 000x magnification. Most fractography analysis can be performed 
effectively in the range of 100x to 10 000x magnification. 


Transmission electron microscope (TEM) 


9.10.6 Occasionally, it is necessary to enlarge the sample image even more than the limit for the SEM, In this 
case the next resource for the investigator is the transmission electron microscope (TEM). Interestingly, the TEM is older 
than the SEM, which has only been available for perhaps 10 to 15 years. The limitations for the TEM are that it looks at 
a replica of the sample and not the sample itself, and it can only look at a tiny area (perhaps 2mm x 2mm) which may 
hence not be representative and could lead to the wrong conclusion. In practice a plastic model is made by impressing 
the fracture into a moldable plastic, removing the plastic, “shadowing” it with a very thin coat of metal, dissolving away 
the plastic and then passing a wide area beam of electrons through the metal film (the replica of the fracture surface). 
The image produced by collecting the electrons which passed through the replica can be interpreted to deduce the 
micro-fractography of the sample (the image is not very similar to an optical image, but is more like an x-ray print or 
shadowgraph). Since the TEM is using electrons instead of visible light, the limitation is the wavelength (as with light) of 
electrons; hence magnifications of up to 1 000 000x life size are possible. 


Conclusion 


9.10.7 In real life the investigator would progress from naked eye through magnifier to optical stereomicroscope to 
SEM and possibly TEM as necessary to deduce the fracture mode. The great advantage of all these techniques is that 
the sample is not damaged in any way by any of the techniques (at least this is true for engineering alloys) and thus the 
sample is still available for further examination in its original state. 


9.11 AGING AIRCRAFT ISSUES 


General 


9.11.1 The expected service life of an aircraft or individual component is often specified in the design stage in 
terms of total operating/flight hours, total number of flights, or perhaps a number of certain mission profiles. Whether or 
not the structure or its parts achieve these figures depends on the properties of the aircraft materials and their abilities to 
withstand the effects of the actual usage spectrum. It should be emphasized that this spectrum involves more than just 
flight hours. While the aircraft is in flight, dynamic factors — fatigue, flutter, vibration (and to a lesser extent, creep) — are 
the primary determinants of component life. However, when the aircraft is on the ground, corrosion becomes of primary 
concern. 
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Corrosion 


9.11.2 Corrosion is sometimes described as nature’s attempt to return a metal to its natural state; for example, the 
metal oxide ore from which it was produced. This implies that if a metal structure is not protected, the environment will 
degrade the chemical and physical integrity of the metal, eventually leading to failure of the part. Indeed, this is the case, 
but investigators should keep in mind that corrosive agents cause deterioration of all types of materials. Ceramics, as 
well as metals, may react with environmental gases, especially at elevated temperatures, with the material being 
destroyed by the formation of various compounds. Composites corrode if moisture is allowed to reach the epoxy matrix, 
and polymers, in general, degrade when exposed to oxygen at high temperatures. Some materials suffer damage from 
less common sources such as radiation or bacteria. 


9.11.3 Corrosion is a natural and ever-present phenomenon, and, like fatigue and creep, a cumulative and 
irreversible process. For the discussion that follows, corrosion is defined as the destruction of a material by chemical or 
electrochemical means. 


Chemical corrosion 


9.11.4 Chemical corrosion occurs when a corrosive agent causes a material to dissolve, forming corrosion 
byproducts. This can be seen in the attack of water on iron, which causes the familiar rust by-product. The same effect 
would be seen on unpainted aircraft skin exposed to oxygen. A thin film of aluminium oxide would rapidly form. Once the 
oxide film forms, however, the corrosion stops. Because of this, aluminium alloys are often called corrosion resistant. 
Unfortunately the oxide is powdery and easily removed, so its value as a protective coating is limited. 


9.11.5 Selective leaching is a form of corrosion in which one particular constituent of an alloy is attacked and 
dissolved from the solid. An example is dezincification of brass containing more than 15 per cent zinc. The process 
proceeds at high temperatures and the brass eventually becomes porous and weak. 


9.11.6 Polymers also undergo chemical attack. In this case, solvents may diffuse between the molecular chains, 
leading to softer, lower-strength polymers. High rates of diffusion can cause swelling which may lead to stress cracking. 
This is sometimes seen in the action of water into nylon. 


9.11.7 A final example in this section is one more likely to be familiar to pilots and maintainers. This is the reddish- 
bluish discoloration or dulling appearance on sections of tailpipes or exhaust pipes. Known as high temperature 
oxidation, this reaction generally takes place without the presence of aqueous moisture. 


Electrochemical corrosion 
9.11.8 Electrochemical corrosion is the most common form of corrosive attack on metals. It occurs, in general, 


when metal atoms give up electrons and form ions. This action causes the metal to be gradually consumed and a 
corrosion byproduct to be formed. 


Ill-9-74 
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9.11.9 


The process occurs most frequently in an aqueous medium of almost any liquid or in moist air. This gives 


rise to an electric current and the overall effect is similar to a battery. 


9.11.10 


9.11.11 


As in a battery, there are four components to an electrochemical cell: 


a) The anode, which gives up electrons to the circuit and corrodes; 


b) The cathode, which accepts electrons from the circuit; 


c) A liquid electrolyte, which provides a conductive path for the metallic ions from the anode to the 


cathode; and 
d) An electrical connection between the anode and cathode to carry the electrons (usually metal-to-metal 
contact). 


The four components above are illustrated in Figure IIl-9-66. They are the same in electrochemical 


corrosion or electroplating. Eliminating any one of the four will effectively stop either process. 
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Figure Ill-9-66. Typical electrochemical cell 
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Uniform attack 


9.11.12 When a metal is exposed to a corrosive agent that acts as an electrolyte, some regions of the surface can 
be anodic to other regions. The locations of the anodic and cathodic regions move and may even reverse over time. 
Since the regions continually shift, however, the net effect is to cause a uniform corrosion of the metal surface. 
(Figure IIl-9-67.) 


Pitting corrosion 


9.11.13 Pitting is the most common form of corrosion in aluminium and magnesium alloys. It generally starts at 
very small, random sites on unprotected metal surfaces, appearing first as white or gray dots, and later as a powdery 
residue. (Figure Ill-9-68.) 


9.11.14 While the surface pits may not seem severe, the interior damage to the metal is extremely large in 
proportion. A pit usually will have a sharp, well-defined edge with walls oriented somewhat perpendicular to the surface. 
The pit is capable of penetrating deeply into the metal and failure may occur before the extent of damage is recognized 
from the surface effects. 


9.11.15 Water, acid, alkali, and saline solutions all act as electrolytes in supporting pitting corrosion. 
Galvanic corrosion 


9.11.16 If two different metals are electrically connected and subjected to the same corrosive element, galvanic 
corrosion can occur. This is often called “dissimilar metal” corrosion. In this case, one metal acts as an anode, giving up 
valence electrons to a less active metal, the cathode, and a typical electrochemical cell reaction takes place. 


9.11.17 Galvanic corrosion is seen in aircraft structures where two metals are in contact and the interface is 
exposed to water or other fluids. Uncoated steel and aluminium, or copper and aluminium are examples of combinations 
which can result in galvanic corrosion. The galvanic action will be apparent in the localized corrosion of the anode 
(active metal) near the interface of the two metals. A third combination, magnesium and steel, is shown in Figure II|-9-69. 


9.11.18 The activity of dissimilar metal combinations can be qualitatively gauged from a galvanic series of metals. 
In general, the farther apart two metals appear in the series, the more active they will be in combination. 


Crevice corrosion 


9.11.19 If moisture can reach the crevices, or interfaces, between joined structures, it can cause a form of 
corrosion called crevice, or oxygen concentration cell corrosion. The latter name refers to the electrolytic cell formed by 
moisture and the metal surface. The moisture shields the metal from oxygen and creates an imbalance in the amount of 
oxygen available to the metal above the moisture. This difference in concentration causes the crevice tip to act as an 
anode to the surrounding base metal. 


Intergranular corrosion 


9.11.20 Intergranular corrosion occurs when there is galvanic corrosion activity at the microscopic level. This 
involves the grains of an alloy in which processing or subsequent precipitation of a constituent metal causes the grain 
boundaries to be chemically different from the interior (e.g. copper ions in 2024 series aluminium alloy). If an electrolyte 
reaches these grains, galvanic action takes place resulting in cracking and weakening of the alloy. Exfoliation of 
aluminium alloys and sensitization of stainless steels are forms of intergranular corrosion. (Figures III-9-70 and III-9-71.) 
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Figure IIl-9-67. Uniform corrosion 





Figure IIl-9-68. Pitting corrosion 
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Figure IIl-9-69. Galvanic corrosion cell formed by steel fastener in magnesium alloy 





Figure Ill-9-70. Final fracture associated with intergranular corrosion 
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Exfoliation corrosion 


9.11.21 Exfoliation is a form of intergranular corrosion in which the corrosion attacks the metal interior along paths 
parallel to the surface. This is often identified by the lengthwise fragmentation of rolled or extruded aluminium alloy 
structural shapes. The grains are longer and more directional as a result of the manufacturing process and if corrosive 
agents reach an edge where more grain boundaries are exposed, penetration of the metal can be severe. 


9.11.22 The grain’s elongated shape will restrict movement of the corrosion toward the surface and, instead, steer 
it along a parallel path. Corrosion of the elongated grain boundaries creates a light, grey coloured aluminium oxide 
byproduct. As the corrosion product grows it causes swelling and, eventually, cracking between the grains. The metal 
then appears to separate and peel off as though layered. (Figure IIl-9-72.) 


Sensitization 


9.11.23 True stainless steels contain a minimum of 12 per cent chromium and may contain as much as 30 per cent. 
At 12 per cent and above, the chromium content is sufficient to form a thin oxide film on the surface. This gives the 
steels good corrosion resistance, thereby justifying the term “stainless”. 


9.11.24 However, stainless steels also contain approximately 0.08 per cent carbon. This generally is no problem, 
but if, for example, a type 304 stainless steel is heated to between 850°F and 1 450°F (455° C and 788°C), the carbon 
will combine with the chromium to form chromium carbide. The carbides form in the grain boundaries and deplete the 
boundary areas of chromium. The boundaries thus lose their chromium oxide film protection and intergranular corrosion 
will occur in the presence of water that is slightly acid. This effect is called “sensitization”. A sensitized steel is one that 
experiences intergranular corrosion due to grain boundary carbide precipitation. 


Filoform corrosion 


9.11.25 Filoform corrosion occurs in a random, thread-like pattern often compared to the traces of insect borings 
under the bark of trees. It can be found on the surface of metal skins, under protective coatings, such as polyurethane 
paint, and in the epoxy matrix of some composites. 


9.11.26 While not very destructive on its own, filoform corrosion may facilitate attack by other forms of corrosion. In 
composite surfaces it could lead to delamination of the composite layer. (Figure II|-9-73.) 


Stress corrosion cracking 


9.11.27 This type of damage is caused by the combined effects of tension stress and a corrosive environment. The 
stress may be stored residual stress or the result of applied tension loads. Neither the stress level nor the corrosion 
effects alone are of serious magnitude; the synergistic action, however, causes fractures at stresses well below the yield 
strength of the metal. 


9.11.28 Stress corrosion cracking usually begins with a breakdown in the protective coating on the metal’s surface, 
allowing corrosive attack to begin. Electrochemical corrosion then produces a network of fine cracks with extensive 
branching along grain boundaries (secondary cracks spreading sideways from the main crack). The cracks form 
perpendicular to the main tensile stress axis, which may be from either applied or residual stresses in the part. The 
origin of the cracking can often be determined by the presence of a corrosion product. The metal as a whole, however, 
will show very little uniform attack. 
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Figure IIl-9-71. Photomicrograph of grain structure of metal damaged by intergranular corrosion 





Figure III-9-72. Exfoliation corrosion 
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9.11.29 The final fracture may occur as a sudden, brittle fracture, even in ductile metals. In addition, the corrosion 
pattern may resemble the stop marks of fatigue, or the cracking may be confused with hydrogen embrittlement. Because 
of these factors, the investigator may need to rely on laboratory analysis for the final answer. 


9.11.30 Higher strength alloys, hardened steels, high strength aluminium alloys, and titanium, are prone to stress 
corrosion cracking. (Figure III-9-74.) 


Corrosion fatigue 


9.11.31 As the name implies, corrosion fatigue is the result of simultaneous exposure of a metal to a corrosive 
environment and the cyclic tension stresses of fatigue. Once the protective finish is penetrated, pitting corrosion can 
create stress raisers and the cyclic stresses can initiate one or more fatigue cracks. 


9.11.32 It is also likely that the fatigue cracks may develop first and provide the conduits for the corrosive agent. In 
either case, the corrosive effects at the crack tip will cause the cracks to propagate faster than they would in a corrosion- 
free environment. These combined effects are of concern since they can significantly decrease both the fatigue strength 
and fatigue life of a component. 


9.11.33 The investigator's task may be further complicated by the corrosive agent’s tendency to obscure the 
fracture surface and its key markings. Again, a laboratory analysis may be needed. (Figure IIl-9-75.) 


Fretting corrosion 


9.11.34 Fretting is a form of erosion that results from low amplitude rubbing of highly loaded surfaces in contact. 
The abrasive wear removes hardened or protective surface coatings and exposes the base metal. Oxygen or other 
corrosive agents are then free to invade and attack the base metal, causing fretting corrosion. 


9.11.35 The mechanical portion of fretting corrosion can be identified by surface roughness and discoloration. 
Steels will display a red-brown discoloration; aluminium fretting debris is usually black and powdery. Fretting is also 
frequently identified with the origins of fatigue cracks. Once fretting damage has occurred, the area is susceptible to 
attack by corrosion elements and further damage by fretting corrosion. (Figures III-9-76 and III-9-77.) 


Hydrogen embrittlement 


9.11.36 Some metals and alloys, especially high strength steels, are susceptible to cracking caused by unwanted 
hydrogen in the crystalline structure. The hydrogen atoms may be introduced during manufacturing processes — 
electroplating is an example — or they may come from water in the atmosphere or wash solutions if bare metal is 
exposed in in-service operations. 


9.11.37 Hydrogen embrittlement is often seen in landing gear components, which are typically cadmium-cladded 
steel structures. Over time the hydrogen may collect at the interface of the steel component and its cadmium coating, 
where it expands and causes catastrophic cracking. To prevent this, landing gear and similar components must be 
baked at about 400°F (200°C) for several hours to expel the hydrogen. 


9.11.38 Hydrogen embrittlement cracks will normally be intergranular and, therefore, highly branched. The fracture 
surface will resemble a brittle fracture and can easily be confused with stress corrosion cracking. 
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Figure Ill-9-73. Filoform corrosion can be seen in metals and some composites. 





Figure Ill-9-74. Stress corrosion cracking may be identified by the presence of multiple, 
fine cracks in high-strength alloys. 
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Figure Ill-9-75. Corrosion fatigue is the combined action of corrosion and 
the fatigue process on a metal. 





Figure Ill-9-76. Fretting corrosion 
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Figure Ill-9-77. Damage caused by fretting corrosion. Fretting corrosion may be considered 
as mainly mechanical wear with some combined corrosive action. 


Aircraft wiring 


9.11.39 Following the tragic accidents involving TWA 800 (1996) and Swiss Air 111 (1998), greater emphasis has 
been placed on the occurrence of electronic hardware failures, particularly wiring. As wiring ages along with the aircraft 
structure, the insulation and jacketing may become brittle and crack, exposing the copper strands. Consequences of 
such damage include arcing, fire, short circuits, and electromagnetic interference. 


9.11.40 Wiring bundles are subject to mechanical damage through chafing against structural members or adjacent 
bundles. At elevated temperatures, polymeric insulation materials are subject to chemical breakdown. Further chemical 
damage will like occur in the presence of corrosive agents. These agents range from ever-present moisture to fuel, oil, 
hydraulic fluid, galley and lavatory fluids, and even corrosion treatment fluids for metals. 


Arcing 
9.11.41 Although many conditions can lead to electrical failure, perhaps the most serious is arcing. Arcing is the 


discharge of electricity across a gap between electrical conductors. Thus, whenever wiring in the proximity of structure is 
exposed, the potential for arcing and fire is present. 
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9.11.42 Safety personnel cite four kinds of arcing, or wire faults, associated with damaged insulation. These are: 


a) Teased faults. Sometimes known as “sliding faults,” these refer to arcing that occurs when the 
insulation is chafed or rubbed to the point where the wire is exposed, thereby opening a path for 
arcing. 


b) Ticking faults. These are arcing events of short duration, on the order of a few milliseconds. The 
voltage normally drops to a low level while the amperage increases by a factor of 10 or more. 


c) Wet arc tracking. This is a form of ticking fault that is enabled and supported by moisture-damaged 
insulation. Wet arc tracking causes a carbonization of the insulation. 


d) Dry arc tracking. Also known as “dry banding,” this is the explosive loss of an entire wire bundle. 
Because free carbon is needed for this event, this type of failure only occurs in insulation materials 
with a high carbon content, such as polyimide or Kapton. 


Wiring assessment 


9.11.43 Visual inspection remains the most common method of checking wiring bundles but, considering the more 
than 200 km of wiring that snakes through the typical wide-body transport, it is apparent that many sections of wiring will 
not be inspected. To aid the individual inspector, several techniques involving reflectometry are now in use or under 
development. These include: 


a) Time domain reflectometry (TDR). This technique is typically used when a wiring problem is 
suspected. A rectangular pulse is applied to a cable and the cable’s impedance, termination, and 
length create a unique signature on the reflected signal. Interpretation of the results can be difficult 
and requires a skilled operator. 


b) Standing-wave reflectometry (SWR). A simpler (and less expensive) method than TDR, SWR involves 
applying a sinusoidal waveform to a wire. The reflected signal is also a sinusoid, and the two signals 
add to create a standing wave on the wire. The peaks and nulls of the wave are then read to obtain 
information on the length and terminating load of the wire. 


c) Frequency domain reflectometry (FDR). This technology also uses sine waves, but measures the 
phase difference between incident and reflected signals. Faults in a line will generate resonances 
between the signals and can be interpreted by the operator. When fully developed, this system may 
allow automatic preflight testing of cables. 


9.11.44 Because many wiring faults occur during flight, work is under way to develop so-called smart wire systems. 
Utilizing micro-miniature components, these systems will provide continuous monitoring of cables before and during 
flight. The ultimate goal of such systems is to be able to identify and correct faults as they occur. 


9.11.45 Newer aircraft will also employ arc-fault circuit breakers as standard equipment to protect against the 
threat of arcing and fire. Using sophisticated electronics, these units can discriminate between normal current overloads 
and arcing current, and can respond appropriately to each. Many older aircraft are being retrofitted with arc-fault circuit 
breakers in configurations which either replace or can be used in tandem with ordinary heat-sensitive breakers. 
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9.12 SERVICE LIFE EXTENSIONS 


General 


9.12.1 Mainly due to economic factors, many operators are electing to refurbish and maintain their existing aircraft 
rather than purchase new ones. This fact was recognized in 1988 when an international conference established the 
worldwide Aging Aircraft Program. At that time the number of the world’s transport aircraft flying beyond their design life 
had already exceeded 20 per cent. That number has continued to grow, supported by better analysis of aging factors, 
improved inspection techniques, and greater operator/maintainer awareness. 


9.12.2 Ongoing efforts to achieve service life extensions focus mainly on the destructive roles of fatigue — the 
primary cause of structural failures — and corrosion — the most expensive aspect of maintaining structural integrity. 


Service life extension procedures 


Safe-life approach — Fatigue 


9.12.3 This approach establishes in-service replacement times for components, based on laboratory fatigue 
testing and modified by safety factors. Upon reaching its calculated replacement time, the component’s safe life is 
considered expired and the part is retired despite the absence of fatigue cracks. Shortcomings of this approach are (1) 
the laboratory testing does not consider the presence of manufacturing or maintenance-induced defects in operational 
items, and (2) the replacement times are not statistically derived. The latter case causes premature removal of safe 
components. 


Fail-safe approach — Fatigue 


9.12.4 The basis of the fail-safe approach is the design of multiple load paths into critical components. The 
concept is that should there be a failure of a primary load-bearing structural member, there will remain in adjacent paths 
sufficient integrity to continue flight to landing. While currently in use in the design of many components, this approach 
does not cover multiple site damage, where small cracks at fastener holes link up to cause failure. 


Damage tolerance approach — Fatigue 


9.12.5 The approach currently receiving the most attention deals with damage tolerance. Unlike other approaches, 
damage tolerance assumes a minute crack or flaw in the material and uses the techniques of fracture mechanics to 
calculate the time it takes a crack to grow to critical length. Such calculations are then used to define safe-inspection 
intervals. In practice, any size crack actually found during inspection is cause for replacement of the component. 


9.12.6 This approach extends component life by not requiring replacement unless it is damaged, and further 
allows for reduction of safety factors in design. However, application of damage tolerance to establish inspection 
intervals for an aircraft does require careful analysis of its usage profile. 
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Corrosion assessment 
9.12.7 Unfortunately methods do not currently exist for determining corrosion initiation or propagation times. 


9.12.8 While damage caused by corrosion can be life-threatening, in most cases it does not lead to critical 
structural failure. As pointed out, however, it is the most expensive factor in maintaining the safety of older aircraft. 


9.12.9 Approaches to corrosion control typically involve visual inspection and nondestructive evaluation 
techniques for the detection of affected areas. The frequency of inspections will be partly determined by the operating 
environment of the aircraft: high or low altitude operations, salt air or dry air, hangared or kept on the flight line, etc. 
Overall, it is essential that personnel follow the preventive practices and replacement procedures specified by the 
manufacturer. 


Chapter 10 


MID-AIR COLLISION INVESTIGATION 


10.1 INTRODUCTION 


10.1.1 The mid-air collision is one of the classic aircraft accident types that will continue to confront professional 
investigators. Although there have been advances in technology that have reduced the potential for this type of accident, 
they have not been eliminated and it is probable that aircraft accident investigators will continue to investigate this type 
of accident in the future. 


10.1.2 Historically, many of the mid-air collisions which occurred in visual conditions were concluded with some 
type of a finding which said there was a “failure to see and avoid” on the part of both crews. However, a thorough review 
of the facts of the accident may have resulted in completely different findings. Unless it is known that a crew member 
was physically capable of seeing or detecting the other aircraft and that there was sufficient time to react to a sighting, a 
“failure to see and avoid” finding is not accurate. However, with a careful collection of all of the factual evidence and then 
a systematic analysis of the data, an investigator can usually determine the collision angles involved in the accident. 
Once that information is established, the investigator can accurately calculate what each crew member could have seen 
from the cockpit. This information also provides a scientific basis for any safety improvements that the investigator wants 
to pursue. 


10.2 SOURCES OF INFORMATION 


10.2.1 The investigator needs to determine the true airspeeds and relative headings for the two aircraft involved in 
the collision. There are several basic sources of information for doing this: flight recorders, ATS surveillance system data 
(including radar data), physical evidence, witness statements and flight plans. Of these, the most accurate source of 
information is the flight data recorder. If good data is recovered from recorders on each aircraft, it is quite simple to 
determine the collision angle since both headings and airspeeds are known for both aircraft. Even if only one aircraft has 
a flight recorder, it will still provide half of the needed information. 


10.2.2 ATS surveillance system data, if it is available, can provide accurate historical information on the track of 
the two aircraft. Recorded ATS surveillance system data will reveal the location of the aircraft at regular intervals so that 
a track and groundspeed can be calculated. If the winds at the flight altitudes are known, then adjustments can be made 
to the ground speed and track to calculate true airspeed and heading. When ATS surveillance system data is combined 
with the physical evidence in the wreckage then it is possible to know the history of the aircraft tracks leading up to the 
collision as well as any evasive manoeuvres either crew may have attempted. If, for example, the ATS surveillance 
system data shows one collision angle leading up to the collision but the physical evidence shows a significantly different 
collision angle then either one or both of the crews may have attempted an evasive manoeuvre. Combining ATS 
surveillance system data and physical evidence will give a more accurate picture of what took place prior to the collision. 


10.2.3 Witness statements may be valuable if they come from individuals that actually saw the aircraft collide. 
Unfortunately, many witnesses interviewed after a mid-air collision did not actually see the collision but heard the noise 
of the collision and then saw the aircraft falling. This information is not helpful to the investigator. The best witness 
statements may come from surviving crew members. Typically, surviving crew members will relate that they suddenly 
saw the windscreen fill with the other aircraft so suddenly that they did not have time to react. However, if the crew 
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members saw the other aircraft earlier in the collision sequence, they may be able to describe any evasive manoeuvres. 
They may also be able to remember what levels, headings and airspeeds they had prior to the collision. Aircraft that are 
equipped with ACAS (TCAS) and cockpit voice recorders can also provide detection and evasion information. 


10.2.4 A flight plan may be helpful to the investigation. This can be either a filed flight plan with a government 
agency or a company flight plan. A variation of this is to obtain statements from people that can relate how the crew was 
intending to fly that day or how they normally completed similar flights. While none of this information is conclusive, it 
may provide some general ideas about the flight or even a general range of airspeeds that may be useful later. 


10.2.5 Physical evidence from the wreckage is particularly valuable to the investigation if no flight recorders were 
fitted on either aircraft. The scratch marks, prop slashes or other signatures can tell the investigator the actual collision 
angle at the time of the accident. Combined with other information, like ATS surveillance systems data or witness 
statements, it will develop a more complete accident scenario. Flight recorders and ATS surveillance systems data are 
covered in different sections of this manual so this section will expand upon the techniques for using physical evidence 
from the wreckage. 


10.3 USING PHYSICAL EVIDENCE 


10.3.1 When two aircraft collide, they will always create scratch marks and other evidence that represents the 
combination of the vectors of both aircraft. Unfortunately, additional damage such as aerodynamic loads, ground impact 
or fire can mask this evidence so that it is difficult or impossible to locate. When a good scratch mark is located, it is 
tempting to sight along a scratch mark as though that mark represents the flight path of the other aircraft. However, that 
will not be accurate unless one aircraft was stationary or one aircraft was overtaking from the 6 o’clock position or the 
aircraft were approaching head on. As is illustrated in Figure III-10-1, in most cases the scratch mark is a combination of 
movements of two bodies in motion that does not represent the flight path of either aircraft individually. 


10.3.2 The collision angle is the angle between the flight paths of the two aircraft (Figure IIl-10-2). More precisely, 
the collision angle is actually the angle between the headings of each aircraft. It is the one most commonly referenced 
by investigators but the other two angles in the triangle, the convergence angles, normally have greater usefulness. The 
convergence angle gives the visual difference between the aircraft heading and the approaching aircraft. In other words, 
the convergence angle is the relative bearing of the other aircraft or how far left or right (up or down) the pilot would have 
had to look to see the other aircraft. If the speeds and headings of the two aircraft remain constant, both convergence 
angles will also remain constant. In this condition, the converging aircraft will appear motionless to an observer on the 
other aircraft. Since the human eye sees relative motion sooner than a stationary object, this helps to explain why pilots 
do not as readily see aircraft on a collision course. 


10.3.3 It is important to note that the convergence angles have to be based on headings rather than tracks in 
order to establish a valid visual perspective for each crew member. However, since scratch marks are always parallel to 
each other and the closure speed vector, they will always be based on the heading of the aircraft. These headings are 
always a relative angle between the two aircraft headings rather than the actual compass headings of the aircraft. 


10.3.4 Once the convergence angles are established, the visibility from a cockpit can be replicated with good 
accuracy. A visibility study done with a computer will provide a graphical plot of what the pilot(s) could have seen from 
the cockpit. The pilot’s visibility can also be assessed manually by reconstructing the pilot's seated height and seat 
location in a similar aircraft and then determining what is visible at the convergence angle. If there is windscreen 
surrounding this point and there was no other interference, such as from the sun, the pilot had the potential of seeing the 
other aircraft at some point in the accident sequence. If there is structure in this location, it is then necessary to calculate 
when the size of the other aircraft would have been larger than the relative size of the structure and then, using the 
closure speed, calculate the time until impact. When combined with the time allowed for the crew to identify and react to 
the target, calculations will show if the crew was even capable of avoiding the collision. Likewise, if the relative location 
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of the converging aircraft was in a position normally not scanned, it is not reasonable to expect the crew to have seen 
the other aircraft. Of course, these calculations work best with two aircraft that have continued for some time in a 
consistent flight path before impact. Spending the necessary time to obtain the proper information will provide the 
investigator with greater insight into the actual circumstances of the accident even with changing flight paths. 


10.3.5 For larger aircraft, modern aircraft simulators are available to recreate the event with representative 
weather, converging aircraft aspects, cockpit operations and air traffic control guidance information. In this respect, the 
actual flight and cockpit conditions can be investigated to determine if the crew had sufficient internal or external 
capabilities to identify and avoid the collision. Recreation of near mid-air collisions may be even more beneficial than 
post-accident investigation. Given the complexity of flight deck management requiring more pilot emphasis inside the 
cockpit, and the increasingly precise satellite navigation capability of aircraft, aircrew are spending much less time 
looking outside while the randomness of surface-based navigation aids has been removed. Therefore, vigilance in 
compliance with procedures and use of surveillance enhancement equipment is vital as terminal and enroute airspace 
becomes more crowded. 


10.4 LOCATING AND MEASURING VALID SCRATCH MARKS 


10.4.1 One of the critical aspects of using physical evidence is the selection of scratch marks. A valid scratch 
mark will always be straight and will ideally have a paint transfer from the other aircraft. Find a scratch mark on a 
horizontal surface to determine the horizontal convergence angle and a scratch mark on a vertical surface to calculate a 
vertical collision angle. While it is possible to use scratch marks from other surfaces or even a curved surface and then 
convert them to an “equivalent” mark on the appropriate surface, the easiest marks to use come from flat horizontal or 
vertical surfaces. These marks can be directly measured in reference to the rivet lines that correlate to the longitudinal 
axis while at the accident scene or even measured later from photographs. When using photographs to make 
measurements, it is critical that the photo be taken perpendicular to the scratch mark surface and that the scratch marks 
are in the center of the photo to avoid introducing parallax error or distortion into the measurement. (Figures Ill-10-3 
and III-10-4.) 


10.4.2 While it is preferable to obtain the scratch marks from the initial contact points of the two aircraft, this is not 
always necessary. When the two aircraft do not significantly alter their flight paths during the impact, scratch marks 
made later in the collision are acceptable. However, the more direct the collision, the more important it is to use scratch 
marks from the initial contact. 


10.4.3 Changing the direction of a flying aircraft is a function of two variables. There is the force applied and the 
time that force is applied. The more direct the impact (force) or longer the contact (time), the more important it is to use 
scratch marks made early in the collision sequence. While, theoretically, any contact with another aircraft during a mid- 
air collision will change the direction of both aircraft after initial impact, this change is insignificant for many collisions. 
Even for slower aircraft, the time of contact between the aircraft is usually measured in milliseconds. Therefore, the only 
time there will be a significant change in the direction of an aircraft while the scratch marks are being created is when 
there is a very large force applied, such as in a head-on collision, or when there is a longer time for the two aircraft to 
interact, such as when one aircraft is slowly overtaking the second aircraft. Winds will create varying degrees of 
differences between the aircraft's heading and track. 


10.4.4 Once a scratch mark has been located, its direction and the angle it forms with the longitudinal axis of the 
aircraft needs to be documented. It should be noted that if a horizontal scratch mark is measured with reference to the 
lateral axis or a vertical scratch mark is measured with reference to the vertical axis, the angle it makes with the 
longitudinal axis can easily be calculated. While examining the aircraft wreckage, the investigator only needs to find 
good scratch marks and accurately measure them in reference to a horizontal, lateral or vertical aircraft axis as 
appropriate. The actual calculations for determining collision and convergence angles can be done later. 


Part Ill. Investigation 
Chapter 10. Mid-air Collision Investigation Ill-10-5 





10.4.5 The intersection of a scratch mark with the longitudinal axis forms four possible angles for measurement. 
However, since the opposite angles are equal and the total of the angles on one side of the scratch mark is always 180 
degrees, even if the “wrong” angle is measured on scene, the correct angle can be easily determined later. Although the 
“wrong” angle will frequently work mathematically to give the right answer when using sine functions, the best approach 
is still to use the correct angle for the measurement. When viewed perpendicular to the scratch mark surface, the slope 
of the scratch marks and their direction will determine the proper angle to measure. A summary of the rules for which 
angle to measure as well as the significance of the direction and slope of the marks with reference to the longitudinal 
axis, are in the following guidelines. Although these guidelines will apply to both horizontal and vertical scratch marks, 
they are covered separately for clarity. 


Horizontal surfaces 


10.4.6 1) If the scratch marks on each aircraft slope in opposite directions with respect to their longitudinal axis, 
then the smaller angle between the longitudinal axis and the scratch mark is the one to be measured 
on each aircraft (1 in Figure Ill-10-5). 


2) If the scratch marks on each aircraft slope in opposite directions, as in 2 in Figure III-10-5, then each 
scratch mark was made in a direction proceeding from front to rear. The smallest angle between the 
longitudinal axis and the scratch mark indicates the relative bearing at impact. 





Figure Ill-10-3._ Scratch marks on a horizontal surface photographed 
from overhead. Note the straight lines. 
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Figure IIl-10-4. A vertical surface of a fuselage photographed from the side. 
Note the straight scratch marks and the relatively small angle formed 
with the longitudinal axis, showing little relative vertical movement in this collision. 


3) If the scratch marks are sloped in the same direction, then one aircraft overtook the other, and the 
larger angle between the longitudinal axis and the scratch mark is measured on the slower aircraft. 
The smaller angle is measured on the faster aircraft (3 in Figure III-10-5). 


4) If the scratch marks are sloped in the same direction, one of the scratch marks had to be made ina 
direction proceeding from rear to front. The aircraft on which this mark appears is the slower aircraft. 
The larger scratch angle will always be on the slower aircraft (3 in Figure III-10-5). 


5) If the scratch mark angle on one aircraft is the same as the scratch mark angle on the other aircraft, 
then the speeds of the two aircraft are the same. 
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Vertical surfaces 


10.4.7 The principles for interpreting scratch marks to determine vertical movement are similar to those used for 
horizontal movement except that you use scratch marks on a vertical surface rather than a horizontal surface. The 
scratch marks are still measured relative to the longitudinal axis of the aircraft. 


1) When the scratch marks slope in opposite directions and proceed in a generally bottom to top direction, 
the aircraft collided in a relatively nose-up attitude with respect to each other (Figure IIl-10-6). Likewise 
when the scratch marks slope in opposite directions and are generally going top to bottom on both 
aircraft, they collided in a relatively nose-down attitude with respect to each other. In both cases you 
measure the smaller angle between the longitudinal axis and the scratch marks on each aircraft 
(Figure III-10-6). 


2) If the scratch marks go from top to bottom on one aircraft and bottom to top on the other aircraft with a 
slope in the same direction, then one aircraft overtook the other, and the larger angle between the 
longitudinal axis and the scratch mark is measured on the slower aircraft. The smaller angle is 
measured on the faster aircraft (Figure III-10-7). 


3) If the scratch marks on the slower aircraft proceed from bottom to top, then that aircraft was above the 
other. Conversely, if the scratch marks on the slower aircraft proceed from top to bottom, then that 
aircraft was beneath the other (Figure II|-10-7). 


10.5 METHODS OF CALCULATING THE COLLISION ANGLE 


10.5.1 There are several methods to determine the collision and convergence angles in a mid-air collision. The 
most basic approach is to use graph paper to plot out the track and magnitude (speed) of each aircraft. If all four of 
these values are known, they can be plotted and the angles they form measured. The advantage of this approach for 
some people is that it does not involve mathematical formulas. However, the significant disadvantage to this method is 
the necessity of knowing the speed and direction for both aircraft. 


10.5.2 Trigonometric functions allow the investigator to determine the collision and convergence angles using 
the Law of Sines and the Law of Cosines when only three of the four values are known. This approach is shown in 
Figure IIl-10-8. This approach also allows for establishing reasonable estimates when only two of the four values are 
known, as illustrated in Figure IIl-10-10. 


10.5.3 The techniques discussed in this chapter have been limited to determining horizontal angles of 
convergence and collision separately from vertical angles of convergence and collision. While both calculations can be 
done simultaneously, a simpler technique is to do two separate sets of calculations. Solve for the horizontal 
convergence angles and then solve for the vertical convergence angles. Once this is done, the two angles can be 
combined to describe a convergence angle as X degrees horizontally and Y degrees vertically. 
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Figure Ill-10-5. 

















Figure Ill-10-6. 
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Figure Ill-10-8. 
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10.6 DETERMINING COLLISION AND CONVERGENCE ANGLES IN DIFFERENT SCENARIOS 


Scenario 1: When both aircraft have good scratch marks 


10.6.1 When both aircraft have reliable scratch marks, solving for the collision angle is a simple process. Since 
the scratch marks are the same as the respective convergence angles, it is simply a matter of subtracting the two 
scratch mark angles from 180 degrees to get the collision angle. Depending on the speed of the two aircraft, this may be 
all that is needed since the two convergence angles are all that is needed to establish potential visibility for both crews. 
For faster aircraft, it will still be necessary to determine the speed of both aircraft in order to determine the closure speed. 


10.6.2 In one simple example, two small aircraft collided over a metropolitan area during night VFR operations. 
One aircraft crashed into a shopping center while the second aircraft made a successful emergency landing at a nearby 
airport. Good scratch marks were available for both aircraft. One had a mark going from the leading edge to the trailing 
edge on the right wing measuring 37 degrees from the longitudinal axis. The second aircraft had a scratch mark on the 
left wing going from the leading edge to the trailing edge measuring 34 degrees. Since these scratch marks are the 
same as the convergence angles, the collision angle is easily calculated. Subtracting the sum of the two scratch marks 
(convergence angles) from 180 degrees produces a collision angle of 109 degrees as illustrated in Figure Ill-10-9. 


Scenario 2: When only one aircraft has a good scratch mark 
and the speed of the two aircraft can be determined or estimated 


10.6.3 When one convergence angle and two airspeeds are known or two convergence angles and one airspeed 
are known, the remaining value can be obtained using the law of Sines. However, when only one convergence angle 
and one airspeed are available, it is still possible to calculate a range for the missing convergence angle. While any 
estimate introduces some error into the results, a range of probable speeds can be used and the resulting range of 
probable collision angles will provide useful information to the investigation. As can be seen in Figure IlII-10-10, the 
variation in one general aviation accident was only about four degrees for a 10 per cent variation in airspeed. While it is 
desirable to have higher precision, this range can still be very useful in a visibility study. 


When neither aircraft has a reliable scratch mark 


10.6.4 Sometimes the extent of the impact damage or fire makes it impossible to find reliable scratch marks on 
either aircraft. When this happens, it may be necessary to use an “equivalent” scratch mark. If it can be determined from 
the wreckage what the direction of damage was from the second aircraft, this can be used as a rough indication of an 
“equivalent” scratch mark. This technique will provide some information on the collision angle between two aircraft. 
While precision suffers doing this, it may be the only option available. 


Propeller slashes 


10.6.5 When one or both aircraft involved in a mid-air collision have propellers, there may be prop slashes that 
can be used to calculate collision and convergence angles. Multiple prop slashes will be somewhat parallel. While the 
speed of the blades will definitely change depending on the power on the propeller and the material it is cutting through, 
that will not have a significant effect on the collision angle calculations. Even when the slope of multiple slash marks are 
changing noticeably or the slash marks are different lengths, the investigator can connect the mid points of complete 
slashes to form an equivalent scratch mark since the midpoint is the location where a prop blade was vertical each time. 
This eliminates the concern about the changing slope of the slash marks and usually makes for an easier calculation of 
the convergence angle. This equivalent scratch mark is used to calculate the convergence angle just like a normal 
scratch mark. The distance between the slashes are representative of the closure speed and this calculation is definitely 
affected by the changing prop speed. (Figure III-10-11.) 


Part Ill. Investigation 
Chapter 10. Mid-air Collision Investigation 


II-10-11 








MEASURE THIS 
ANGLE (37°) 





A 
SCRATCH MARK 
LONGITUDINAL COLLISION 
AXIS ANGLE 
Cc 








180°-37°-34°= 109° 


CONVERGENCE 


ANGLE ANGLE 


CLOSURE SPEED 





CONVERGENCE 








Figure IlIl-10-9. 





Assume 110 Knots for Cessna 172 


Sin 44° = Sin ?, ?=34.6° 
110 90 








180° - 35° - 44° = 101° 
Sin 44° = Sin ?, ?=38.7° 
100 90 

















Cessna 172 


90 


44° 





Cessna 152 








Figure III-10-10. 


Il-10-12 


Manual of Aircraft Accident and Incident Investigation 








s x 


Figure Ill-10-11. Connecting the mid points of multiple prop slashes 
will form an equivalent scratch mark. 













Beech 213 


ce Piper Prop 456 
244 + 456” = 517° me 


Tan A = 62° \ 


Sin 102/517 = Sin B/213 
= 24° \ 


C= 180 -102-B=54° x 


517 


C+D=116° 





Figure Ill-10-12. 





Part Ill. Investigation 
Chapter 10. Mid-air Collision Investigation III-10-13 





Using a single prop slash to solve for the collision angle 


10.6.6 A good estimation of the collision angle can be determined when only a single propeller slash is available 
in the wreckage. Calculations or estimates for the speed of the two aircraft and the speed of the propeller tip need to be 
included in the calculations. It is also critical to establish the direction of the propeller tip as it was creating the slash. The 
investigator needs to look carefully at the deformation of the area near the slash to establish the direction the blade was 
travelling when it created the damage. 


10.6.7 By using the diameter of the propeller, direction of rotation for the propeller and the RPM of the propeller, a 
calculation for the prop tip speed is determined using standard trigonometric functions (Figure IIl-10-12). Since the prop 
is always providing thrust at a 90-degree angle with the longitudinal axis of the aircraft, using the square of the prop 
vector and the square of the aircraft speed vector to get the square of the combined vector, represents the prop tip 
moving through space. Combining this prop tip moving through space with the movement of the second aircraft allows 
for the solving of the collision angle between the prop tip and the second aircraft. Then, using basic geometry, the 
collision angle between the two aircraft can be determined as illustrated in Figure IIl-10-12. In this particular example, it 
is necessary to use the Law of Cosines to solve for the closure speed. 


10.7 SUMMARY 


10.7.1 This chapter has provided an overview of mid-air collision investigation process. Aircraft recorders, ATS 
surveillance systems data, witness statements and physical evidence all provide information valuable to the investigation. 
Aircraft flight recorders provide the best information if they are available. ATS surveillance systems data can provide 
good historical data on the tracks of both aircraft when it is available and the physical evidence can provide precise 
information on the relative headings of the two aircraft at the time of collision. Witness statements or flight plans can also 
be helpful in determining general flight path directions but they should be used with caution. 


10.7.2 The aircraft wreckage from a mid-air collision can provide unique and valuable information to the 
investigation process. When flight recorders are not available for one or both aircraft, the physical evidence can be used 
by itself or combined with ATS surveillance systems data to determine what happened. Finding reliable scratch marks 
and measuring them in respect to the longitudinal axis of the aircraft are the essential techniques for an investigator to 
know during the on-scene portion of the investigation. Once these measurements are made, they can later be compared 
to the information in this chapter to analyze the significance of the marks. 


10.7.3 The outcome of the mid-air collision calculations is vital in determining the recommendations to help 
prevent similar accidents. It will allow validation of flight path reconstruction and aircrew sight pictures. It can also be 
linked to automation warning indications, air traffic control and many other aspects in order to better understand the 
conditions facing the aircrews and controllers at the time of the mid-air accident or incident under investigation. 


Chapter 11 


FIRE PATTERN INVESTIGATION 


11.1 OBJECTIVE 


11.1.1 An aircraft fire investigation can be very challenging because many of the indicators can be masked or 
degraded by impact with ground, post-impact fire, fire fighting procedures and wreckage removal. Therefore it is 
important to photograph and document existing conditions as quickly as possible and protect any aircraft parts that 
exhibit pre-crash impact fire traits. In this way the investigator can better determine if an in-flight fire occurred, the extent 
of the fire, its ignition source and how to best counter such hazards in the future. 


11.1.2 The fire investigation team will need the assistance of structural and system experts in order to determine 
the failure modes and sequence of fire propagation. The increasing amounts of high-strength and lightweight metals and 
composite materials will also challenge traditional investigation techniques. 


11.2 FIRE INVESTIGATOR REQUIREMENTS 


11.2.1 The aircraft fire investigator must possess an understanding of combustion and how the various aircraft 
materials will respond to fire. The burning of aircraft materials or the damage from the heat of the fire may leave a 
characteristic predictable result which will reflect what is commonly referred to as a “time-temperature” relationship as 
will be discussed later. In addition, the volume of fuel existing in a crash will lead to a ground fire that may then mask the 
evidence needed in the assessment. Thus the investigator must not only be versed in in-flight fires but must also 
understand ground fires. In this way the investigator can establish and separate fires that resulted in the accident and 
those that occurred post impact. 


11.2.2 Supporting fire evidence for the scenario will be masked by the post impact fire and subsequent fire 
fighting response before the investigator arrives on site. The investigator should expect to see twisted, broken, bent and 
soot-covered parts that bear little resemblance to what the undamaged item would look like. Parts scattered outside of 
the impact crater may be subject to minor soot damage, but may be valuable in establishing the existence or non- 
existence of an in-flight fire. Impact angle will dictate how the wreckage may be distributed around the crash site. 
Secondary impact explosion will also throw parts out. 


11.2.3 Up to this point, the fire investigation process is the same as for any other investigation process. However, 
the path changes and characterization of the fire becomes significant in the investigation. Was there a “big explosion” or 
did the aircraft appeared to crash with very little trailing fire or smoke? The presence of a large fire suggests a 
fuel/hydraulic fed fire. Source of the combustible burning could be a significant fuel leak in the engine area or a fuel tank 
explosion/vapour explosion. Hydraulic fluid could also be a source of combustibles. This is where knowledge of fluid 
flammability enters into the investigation. The commercial phosphate ester based fluids, such as Skydrol, are not readily 
flammable. Mineral oil based fluids are, however, quite flammable in the atomized spray release mode. 


11.2.4 When starting a fire investigation the investigator should first gather all facts that may describe the event. 
Downloads of data from crash survivable data recorders should not be anticipated at the early stages. Witness accounts 
should be reviewed and it should be recognized that historically, any visual observation of an in-flight explosion/breakup 
is usually triggered by sound associated with the event. Reportable sounds can be compared to some other known 
sounds. Review occurrences from prior flights and history of problems with the airframe in question. 
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11.3. INTRODUCTION TO THE COMBUSTION PROCESS 


11.3.1 It should now be apparent that basic understanding of the combustion process is necessary in the 
investigation. Three elements are required for a fire: fuel (combustible), air and an ignition source. The fuel, however, 
must be in the vapour state for the combustion process; liquids and solids do not burn. The chemical properties of the 
combustible in question, as described later, are important in determining the probability of that material contributing to 
the fire. 


11.3.2 Key fluid (fuels/oils) properties such as vapour pressure and flash point tell an investigator at what 
temperature the vapour concentration above the liquid becomes flammable. The auto ignition temperature (AIT) of the 
fluid establishes the temperature where the fluid contact with a hot surface could ignite the fluid. These are only a couple 
of definitions of the flammability terms that are important to the investigator. Important definitions are shown in the 
Appendix to Chapter 11. Once an in-flight fluid-fed fire has started, the combustion process and accompanying 
significant energy release will create conditions that can cause damage to materials that would not occur in a ground fire. 
For example, copper wiring may melt in an in-flight fire, but will normally be unaffected in a ground fire. 


11.3.3 Cabin interior or cargo hold fires are normally associated with the combustion of solid materials. These 
solid materials such as electrical wiring insulation, sound suppression materials, plastic liners, etc. must be subjected to 
a heat or flame source to convert the material to a vapour state that will then burn. This is similar to a wood-burning 
process. Burning a log is difficult, so newspapers or small wood shavings are used as a pilot flame to start the fire. Note 
that these newspapers and shavings have a large exposed area and not a lot of mass to absorb the heat. Energy (heat) 
from this small fire eventually starts combustion of the larger logs. As the fire burns into the log, the supply of air is 
reduced and the fire may be reduced in intensity until stirring removes the charred material layer, exposing a fresh 
surface and allowing air to enter. The combustion process for a “cabin interior fire” will be slow in developing and grow 
only when the output energy exceeds the input energy. 


11.3.4 The melting temperature of a substance is where the material state has changed from a solid to liquid and 
thus one step from the gaseous state required for burning. The ignition temperature of solid materials is based on 
shavings or fine particles. For example, steel wool can readily be burned, while steel tubing (solid) will not be damaged. 
Table Ill-11-1 shows the response of selected solid materials to heating. 


11.3.5 In summary, in-flight fires can be approached with the understanding of the difference in the intensity and 
spread of the fire. Aircraft fuel-fed fires will be very rapid in build-up and intensity. Contrast this with a slow smouldering 
fire involving solid materials found in the cabin or cargo bins. 
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Table Ill-11-1. Solid materials’ responses to heating 
Temperature 

Material Action °F °c 
Paraffin wax Melts 129 54 
Plastic vinyl chloride Melts 185 85 
Polystyrene Distorts 210 99 
Methyl Methacrylate Distorts 210 99 
Styrene elastomer Distorts 220 104 
Melamine Decomposes 266 — 400 130 — 204 
Paper/phenolic Delaminates 250 121 
Nylon (polyamide) Distorts 300 — 360 149 — 182 
Cellulose Decomposes 400 204 
Silicone rubber Softens 425 218 
Zinc Melts 786 419 
Silver solder Melts 1165 — 1450 630 — 788 
Enamel Flakes 1200 — 1400 650 — 760 
Glass Softens 1400 — 1600 760 — 870 
Glaze or electrical porcelain Melts 2250 1232 

11.4 FUEL FIRES AND EXPLOSIONS 
11.4.1 The fuel flammability envelope defines the range of fuel-to-air mixtures that can be involved in a fire. 


Table IIl-11-2 shows fuel properties. The flammability envelope is normally associated with the evaluation of a potential 
fuel tank explosion or determining if leaking fuel would be above its flash point and thus flammable. This range of fuel-air 
mixtures is based on experimental tests and theoretical calculations. At the lower flammability limit, the combustion 
process is controlled by the amount of air (oxygen) available. An excess of fuel establishes the rich limit. If the ratio of 
fuel to air is correct, then all of the fuel is consumed and the maximum energy should be released. Figure Ill-11-1 


reflects the expected flame temperature as a function of mixtures. 


Table Ill-11-2. 


Fuel properties 






























































B. Pt. Cot? Net Heat of Flash Minimum 
Sp. Gr. 90% in air Combustion Point AIT Flammable Limits * 
Mol. Wt. | @ 70°F Lower | Upper 
Fuel (liquid) |(water=1)| °C °F | vol-pct | Btu/1b cal/g °c °F °c °F vol-pct | vol-pct 
Aircraft Fuels 
JP-4 125° 0.76 220 428 2.4 18 710 10 395 -18 0 230 | 446 1.3 8.2 
JP-5 169 0.81 238 460 1.1 18 440 10 245 66 150 | 225 | 437 0.6 45 
JP-6 147 0.84 260 500 1.3 18 620 10 345 38 100 | 230 | 446 0.7 48 
JP-7 0.79 232 450 1.1 18 800 10 445 >60 | 140 | 241 465 0.6 45 
JP-8 164 0.82 250 482 qi 18 400 10 225 46 115 | 225 | 437 0.6 47 
Jet A 0.82 250 482 18 590 10 328 >40 | 105 | 225 | 437 Similar to JP-8 
Jet B 0.76 220 428 18 780 10 435 | <-18 0 230 | 446 Similar to JP-4 
TS (thermally stable) 0.78 222 432 18 400 10 225 >43 | 109 
Kerosene (typical) 0.8 254 490 1:3 18 600 10 335 52 125 | 230 | 446 0.7 4.8 
Gasoline 100/130 0.7 116 240 2.4 19 000 10 555 -45 | -49 | 440 824 1.3 7.1 
Gasoline 115/145 0.7 120 248 2.2 19 000 10 555 -45 | -49 | 470 878 1.2 7.1 
Diesel Fuel (60 octane) 0.8 325 617 225 | 437 
Missile Fuels 
JP-9 138 0.95 260 500 18 090 10 050 23 73 250 | 482 
JP-10 136 0.94 18 100 10 055 53 127 | 245 | 473 
RJ-4 0.93 18 140 10 075 71 160 | 329 624 
RJ-5 1.08 17 760 9 865 104 | 219 | 234 | 453 
RJ-6 1.02 17 700 9 830 61 142 | 232 | 450 
1. From AFAPL-TR-85-2057 dated August 1985. 
2. Calculated values by Cy = L25/0.55; Cy is stoichiometric fuel concentration for complete combustion. 
3. Limits at 25°C (77°F) or above flash point. 
4. Mol. Wt. = 78 at 70°F for fractionated vapour. 
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ADIABATIC FLAME TEMPERATURE 
VS. EQUIVALENCE RATIO 


JP-4S IN AIR, INITIAL TEMP. 500 R AND PRESS. 1.085 ATM. 
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Figure Ill-11-1. Effects of the flammability envelope 
11.4.2 When the burning processes were to take place in a closed fuel tank containing similar vapour mixtures 


noted above, the energy release translates into a temperature increase as the hot gases are generated. If the fuel tank 
were instrumented, pressure transducers would record pressure rises with the maximum being between 7 to 8 times the 
initial pressure. 


11.4.3 Note that as the altitude rises, the air pressure decreases and thus the peak combustion pressure at 
altitude would decrease in the same ratios. If the pressure increase within the tank exceeds the capability of the tank, 
then the tank would fail. This is an explosion. Most aircraft fuel tanks fail at less than 20 psia, thus an explosion within a 
fuel tank would cause catastrophic results. 


11.4.4 All of the fuel vapour would be rapidly consumed in an explosion, leaving little, if any, residue of incomplete 
combustion. The interior of the tank surfaces would be clean and the rapid combustion process, in seconds, would not 
discolour or damage the tank surfaces or wiring. This is one of the examples of time-temperature relationships. Note that 
explosive forces are pushing on tank walls, thus the tank failure mode would be in tension. The fracture surface edges 
should confirm this. Fuel tanks may be surrounded by light structures and, even if the tank did not “blow up”, the light 
structure may separate from the aircraft at this time and not be in the prime impact area. 


11.5 GROUND FIRES 


11.5.1 A ground fire is common with most aircraft accidents and the source of the combustible is the fuel. 
Table Ill-11-3 shows the contrasts between an in-flight fire and a ground fire. In-flight fires can reach temperatures of 
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about 2 500° to 3 000°F (1 370° to 1 650°C) as the fuel mixes with the high volume of outside air. In rare instances, 
where there is a homogenous mixture, temperatures as high as 3 500° F (1 930°C) are possible. Ground fires are 
governed by a diffusion burning process, similar to candle burning where the air (oxygen) has to be sucked into the fire. 
These ground fires will be fuel rich producing black to grey smoke clouds and lots of soot. Soot will cover almost 
everything at the crash site. Soot, which is partially burned fuel, will not adhere to any surface hotter than 700°F (370°C) 
and this is one of the time-temperature relationships that can assist the investigator. Localized strong winds or a 
chimney effect (drawing in air) may result in clean burned surfaces within the wreckage that appear to be out of place. 
Expect pool burning to result in flame temperatures between 1 200° to 1 800°F (650° to 980°C). This temperature can 
melt aluminium but does not affect other metals such as copper. Also observe that as aluminium melts, a dull colour 
oxide is formed on the surface. This aluminium oxide has a higher melting temperature. 


Table Ill-11-3. Comparison of typical fire damage 





Evidence 


In-flight 


Ground 





Fire mechanism 


Pre-mixed fuel-air 


Diffusion flame 





Flame temperature, °F (°C) 


2 500 to 3 000 (1 370 to 1 650) 


1 400 to 1 800 (760 to 980) 





Flame height 


Varies 


Twice the diameter of the pool 





Fire flow pattern 


Molten aluminium 


Follows air stream 


Spatters, following air stream 


Random 


Globs, following gravity 





























Soot Trailing the fire attachment area Random on surfaces < 700°F 
Surface scratches On soot Under soot 
Fracture surfaces Clean Soot covered 
Crumpled parts Burnt/soot Soot on exterior surfaces 
Parts outside of impact zone Burnt/soot Clean 
11.6 IGNITION SOURCES 
11.6.1 Ignition sources available within the aircraft are normally thermal or electrical in nature. However, if cargo 


is incorrectly identified on packages, there may also be chemical ignition sources associated with dangerous goods 
(Annex 18 and Doc 9284, The Safe Transport of Dangerous Goods by Air refer). 


Thermal ignition sources 


11.6.2 Pre-existing thermal ignition sources are normally associated with the engine exterior surfaces, bleed air 
systems, engine exhaust systems or the auxiliary power units (APU). Fuel or oil in contact with these hot surfaces may 
lead to a fire. The evolution of the jet engine has addressed the potential for hot surface ignition on the combustion 
chambers. The engine’s shrouding and design reduce the exposed surface temperatures to less than 700°F (370°C). 
This temperature is significant. Although this temperature is above the fuel AIT of 450°F (230°C), laboratory and scaled 
aircraft nacelle test data has shown that fuel, in a flowing air stream, contacting a surface of less than 700°F (370°C) will 
not be ignited. Engine bays are ventilated as part of the nacelle design. Small private aircraft, however, have exposed 
exhaust manifolds that can be an ignition source. 
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11.6.3 The engine bleed air system transports hot air through a series of insulated ducts with controls and clamps. 
Poorly maintained insulated connections or controls can result in exposed surfaces of greater than 450°F (230° C). If 
fluid is trapped in this area, with no air flow, then auto ignition of the fuel is possible. A bleed air leak could also impinge 
on B-nuts, causing them to loosen and leak fuel. The force from a bleed air leak can erode electrical wiring insulation, 
exposing conductors. 


11.6.4 Overheated fuel pumps, heat from worn carbon bearings and rubbing impellers have all been ignition 
sources in fuel tank explosions. However, electrical ignition has not been an ignition source in fuel tanks. 


Electrical ignition sources 


11.6.5 The aging fleet of all types of aircraft places the wiring at risk of failing. Couple this with the numerous 
inspections, maintenance actions and modifications, and there is the possibility of electrical wire chafing leading to 
arcing and the start of a fire. Chafing is one of the leading causes of electrical fires. The investigator needs to know what 
happens when an electrical wire breaks. If there is no current flowing, the break is clean and displays a typical cup and 
cone fracture with some necking down. When current is flowing, there is arcing on the breaking point. The localized heat 
results in the formation of spherical goblets, or beads on the end of the wire strands. The arcing process also causes re- 
crystallization of the wire strands. What was once a flexible strand, now become stiff. Chafing to the aircraft structure will 
cause pitting and blackening of the area where the arc occurs. Laboratory analysis can confirm the presence of metal 
(copper) transfer. The voltage-current product from an arc provides the thermal source for wire melting. A 20 amp short- 
circuit on a 28 V system results in 560 Watts of power that is dissipated near the arc site. This provides the energy to 
ignite the insulation and other materials. Most accident scenarios require dual failures to result in a fire, but an electrical 
arc can provide both the ignition source and the combustible. Electrical arcing on a hydraulic line, for example, will 
create a fine pinhole mist that is ignited by the arc. 


11.6.6 Arcing can be either AC or DC. AC arc is considered the more severe since the aircraft circuit breakers can 
carry a much higher current load for a short period of time and the sine wave of AC arcs each time the zero point is 
crossed. 


11.6.7 A fire external to the wiring bundle consumes the outer insulation first, leaving the conductor inside clean 
and bright, except where the insulation is burned through. Wires burned because of excess current burn from inside out, 
and the conductor will be dark and oxidized, perhaps without damage to the outer cover. 


11.6.8 Examination of any light bulbs available will help in determining whether or not electrical power was on in a 
particular system at impact. If the filament was hot and thus ductile during impact, it will stretch and distort substantially 
but not break. If the filament was cold during impact, it will break but will not distort or stretch from its original shape and 
pattern. If the glass shattered and the filament was exposed, it will react as described above, but will oxidize and 
discolour quickly. 


11.7 FIRE DAMAGE TO METALS 


11.7.1 Exposure to fire results in loss of strength for metal alloys. For example, 7075 T6 alloy loses 10 per cent of 
its strength after 30 minutes at 400°F (205°C). Caution needs to be exercised in assessment of strength loss as a 
function of the fire exposure. Fire exposure may be localized and the mass of the metal can absorb the heat before there 
is any change in the part. A metallurgy laboratory should be consulted with any questions on strength loss. 


11.7.2 Stainless steel begins to discolour at 800 to 900°F (425 to 480°C), turning from tan to light blue, to bright 
blue, to black. When examining this metal, the investigator should check both sides; the side which has the lighter blue 
was the side opposite the heat source, and the heated area will be smaller in circumference. 
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11.7.3 Reading time-temperature of titanium is difficult, if not impossible. Titanium discolours from tan to light blue, 
to dark blue, to gray with increasing temperature. However, some colour changes are possible when held at a specific 
temperature for a finite period of time. Discolouration of titanium exposed to 600°F (315°C) for 260 minutes will be the 
same as that resulting from exposure to 1 000°F (540°C) for 15 minutes. Titanium has a high affinity for gases when 
heated and a scale will begin to form at about 1 100°F (595° C). Scale depth will increase with time at temperature. In 
general, it exhibits a bluish colour at 1 100°F (595°C). At 1 200 to 1 500°F (650 to 815°C) the gray or yellowish shade 
appears. At 1 620°F (880°C), the metal transformations from alpha to beta state and oxidation rate are increased. 


11.7.4 In-flight titanium (Ti) fires are normally associated with turbine engines. The engine, operating at increased 
pressures, provides the oxygen necessary to burn the titanium oxides. Molten Ti reacts with oxygen to form an oxide 
(Ti02) that stabilizes around 5 600°F (3 095°C). Oxygen enriched air created by the high pressure is required to sustain 
the fire. Titanium fires do not occur at atmospheric pressures. A titanium engine fire will consume the honeycomb 
titanium case, but the large, heavy structure will not be damaged. The engine manufacturer must be consulted for the 
engine series history when there is such a fire. 


11.8 COMPOSITE STRUCTURES 


Composite usage in aircraft manufacturing is becoming more common. Composites consist of layers of fibres bonded 
together with a thermo-setting resin. Fibres are arranged in layers at various angles to achieve the desired strength. 
There are combinations of fibreglass-epoxy, carbon-epoxy and carbon-bismaleimide. When exposed to a fire, the resin 
will be consumed. Epoxy resins begin to decompose at about 500°F (260°C) and newer resins have a higher 
decomposition temperature. The composite “burning” will be most apparent at the trailing edges where the remaining 
fibres will be flailing in the air stream. Fire pattern damage on burnt composites may not be readily apparent and reading 
the windowpaning may be all that is available. Windowpaning results from soot fully covering the upward side of an 
obstruction such as a rib, while leaving a gap or clearance adjacent to the downward side. In a ground fire, the thin 
composite panels may burn leaving the matrix behind. However, pressure from a fire hose may wash away the matrix 
from vertical exposed surfaces. Thicker composites used as main structures should not be damaged to any extent by a 
ground fire. Caution should be taken in moving or handling composite materials as they may pose health issues. 


11.9 OVERVIEW, CRASH SITE ASSESSMENT 


11.9.1 The fire investigator must gain an overall assessment of the fire damage caused by the post-impact fire. 
This will help in discovering if the ground fire has damaged the parts from the aircraft zone suspected to have caused 
the in-flight fire. 


11.9.2 The investigator should expect to see molten aluminium pooled on the ground if there has been any 
significant fire. Thin aluminium panelling will be melted. Thin windowpanes with missing centre sections but not 
exhibiting edge melting are possible. This is caused by thermal stresses of the fire. Thicker cross section members may 
still be intact, but exhibit sagging. It should be noted that the heat capacity of larger members resists melting; the heat 
capacity also creates a hot surface that may be slow to cool down and thus burn off some of the soot in a ground fire 
where surface temperatures are less than 700°F (370°C). Burnt-off decals may contribute to unusual discontinuous burn 
patterns. 


11.9.3 It is important to put together an overall observation of the wreckage pattern. Look for parts that fit together. 
Evaluate the fire damage on both parts and the edges. If the fire pattern appearance carries from one section to the next, 
then the damage may have occurred in-flight. If edge breaks are clean, break-up occurred in-flight or on initial ground 
impact. Uniform soot within the cracks suggests post-impact exposure from the ground fire. It should be observed that 
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the fire damage within any folded areas will be protected from a ground fire. Any significant damage on the interior 
protected surfaces may indicate in-flight damage. Consider exterior damage to confirm. Look for parts thrown clear of 
the impact zone since any fire damage most probably happened prior to impact. See Figure III-11-2. 


IN-FLIGHT VS GROUND FIRE PATTERN EVIDENCE 


Splatter/soot 


on leading edges 


CHECK FIRE DAMAGE PIECES FOR: 
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Figure Ill-11-2. Evaluating fire damage on wreckage 


11.9.4 The aircraft paints will go through a series of colour changes depending on the exposure temperature. 
Tables Ill-11-4 and IIl-11-5 reflect the effects of temperature on epoxy paint and zinc primer, respectively. Correlation of 
observed crash site thermal damage may assist in determining when the event happened. 


Table Ill-11-4. Epoxy paint response to fire 























Temperature, °F (°C) Evidence 
400 (205) Softens 
600 (315) Discolours 
800 — 850 (425 — 455) Blisters 
900 — 950 (480 — 510) Burns off 
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Table IIl-11-5. Zinc primer response to fire 
































Temperature, °F (°C) Evidence 
450 (230) Tan 
500 (260) Brown 
600 (315) Dark Brown 
700 (370) Black 
800 — 850 (425 — 455) Blisters 
11.9.5 It should be noted that the time-temperature relationship is not always precise but can assist in focusing 


the effort in the investigation. An elevated temperature exposure of a few minutes may leave an appearance quite 
similar to exposure to a lesser temperature for a longer time period. Laboratory analysis may be required. Table Ill-11-6 
can assist in correlating the observed fire intensity. 


Table Ill-11-6. Colour intensity of a fire 



































Colour Temperature, °F (°C) 
Faint red 930 — 1020 (500 — 550)) 
Red 1020 — 1200 (550 — 650) 
Orange 1 200 — 1380 (650 — 750) 
Yellow Orange 1 380 — 1 560 (750 — 850) 
Yellow 1 560 — 1 830 (850 — 1 000) 
White Yellow 1 830 — 2 190 (1 000 — 1 200) 
11.9.6 Once an initial evaluation of the crash site has been accomplished, the available photos should be 


compared to what was observed. The investigator should arrange for additional photos to be taken if needed. 


11.9.7 It is highly desirable to look at a “sister” aircraft to become familiar with the normal fluid/dirt streaking on 
both the exterior and the interior of the aircraft. The investigator should look for places where hydraulic residue may 
accumulate; such areas could collect soot. In flight, there should be a distinct flow pattern across the tails, wings and 
underside of the fuselage. Any rivets or protruding areas in the downstream will create a low pressure area and lead to a 
tail on the soot pattern. Such evidence should be looked for at the crash site. 


11.9.8 When the investigator is focusing attention on a certain system, a maintenance specialist should be 
consulted to help identify the components in question at the accident site. It should be noted that all supply-side 
hydraulic tubing is either stainless or titanium and will not be damaged by the fire. Low-pressure return lines may be 
aluminium as is all tubing from small general aviation aircraft. If fluid is contained in the aluminium tubing, fire damage 
may be limited. Empty tubing, caused by depleted systems, will fail in less than five minutes of exposure to fire. 


11.9.9 If there was an in-flight fire of any duration, there should be some significant damage around the area. 
Aluminium will melt and droplets will splatter and adhere to cooler metal surfaces downstream of the fire. Common 
effects of aluminium structures subjected to in-flight fires is that of “broom strawing” or “feathering”: hot metal on impact 
will begin to separate creating fine strands/stratifications of aluminium. This is another positive indication of in-flight fire. 
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11.9.10 In the quest for evidence of in-flight fire, any parts in the upstream flight path or parts that may have been 
buried in the impact crater should not be overlooked. These parts should be free of any ground fire damage. 


11.9.11 Investigation at the crash site should be followed by reconstruction of the aircraft in a hangar. 
Reconstruction will range from laying out the parts on the hangar floor in an expanded outline of the aircraft to 
reconstruction over a frame such as was the case in the TWA Flight 800 crash. Here the investigator wants to piece 
together the parts suspected in the crash. The investigator must be prepared to enter this phase not knowing where the 
fire originated or the exact ignition source. Information on wreckage reconstruction is in Chapter 8. 


11.9.12 Following reconstruction of the aircraft, the investigator should look for a detectable pattern in the direction 
of the in-flight airflow. If there is not continuity of pattern across lines of failure, the observed patterns were formed after 
the aircraft disintegrated. 


11.9.13 An interior cabin fire will be slow in developing and the transcripts from tower interaction with the aircrew 
should direct the investigator to the area of origin. Flight recorder data will indicate the sequence of events in these 
failures. Electrical arcing or circuit overload should be looked for as the ignition source. Cargo hold fire, however, may 
not direct the investigator towards any ignition source. In this instance items being transported that could generate heat, 
chemically react or be acidic in composition, should be sought either from manifest or shipping documents as well as 
wreckage information. 


11.9.14 To permit an evaluation of the temperature reached by the hundreds of heat-damaged aircraft pieces 
during the Swissair Flight 111 investigation, various heat templates or temperature reference coupons were produced in 
a controlled laboratory environment. The coupons consisted of representative samples of MD-11 aircraft materials, 
painted in accordance with the original manufacturer’s specifications. Each temperature coupon was heated at a fixed 
temperature for a specified period of time. Temperature reference coupons were produced at 50°F increments for 
temperatures ranging from 300°F to 1 100°F (150°C to 590°C), and for exposure times of 10, 20, and 30 minutes. Each 
coupon was characterized by a discolouration of the painted finish that was indicative of the bake temperature and 
duration of exposure. The effect of immersion in sea water of the heated samples was also determined; at most 
temperatures the effect on the discolouration was negligible. Hundreds of pieces of aircraft structure and air conditioning 
ducting exhibited indications of heat damage. The recovered pieces were compared to the temperature coupons 
constructed from identical material to determine the approximate temperature and duration of exposure. This information 
was used to establish heat pattern and temperature distribution within the fire-damaged attic area of the aircraft. 


11.10 FIRE PATTERN INVESTIGATION TIPS 


11.10.1 One method of determining whether a part has been subjected to ground fire is to note the location of the 
part in relation to the apparent ground fire area. Parts or molten metal droplets may be shed in flight and found along the 
flight path. Other parts may be thrown completely clear of the fire area by the impact or an explosion. Even parts found 
within the ground fire area may be free of ground fire damage. Frequently parts are buried under a protective covering of 
dirt, both at the initial point of impact and at the point of rest. Sometimes the crash scene will be just a hole in the ground 
and the wreckage must be dug out, in which case the ground fire is very small except for initial explosion, with the parts 
protected from ground fire by the dirt covering. If the crash site is swamp or water, the parts may be shrouded. 
Subsequent to ground fire fighting, the parts may be covered by foam or dry chemical powder or may be submerged 
below the level of unburned fuel. 


11.10.2 Soot patterns are formed as a result of soot drifting with the air stream until it strikes an object to which it 
can attach itself by means of the unburned oils it contains and by electrostatic attraction. One point to remember is that 
soot will not attach itself to surfaces which are heated over about 370°C (700°F). Therefore, areas which show the 
greatest intensity of fire may contain little or no soot. 
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11.10.3 There are several excellent reference books that a Fire Investigator should have on hand while 
investigating aircraft fires. These are: 


“Aircraft Mishap Fire Pattern Investigations”, AFWAL-TR-85-2057 by Kutcha and Clodfelter 
“Aircraft Mishap Investigation Handbook for Electronic Hardware”, WL-TR-4004 by Donald Galler, etc. 


— “Guide for Fire and Explosion Investigations”, NFPA 921. 


Appendix to Chapter 11 


Common Flammability Terms 


Auto-ignition temperature. The temperature at which a flammable gas or vapour-air mixture will ignite from its own 
heat source or a contacted heat surface without necessity of spark or flame. 


Diffusion. The tendency of one gas or vapour to disperse into or mix with another gas or vapour. 


Flame propagation. The spread of flame across the surface of a flammable vapour-air mixture from a single source of 
ignition. 


Flash point. The minimum fluid temperature where sufficient vapours exist to form an ignitable mixture with air near the 
surface of the liquid 


Lower flammable limit (LFL) or (LEL). The minimum vapour concentration at which propagation of flame will occur. 
Propagation of flame will not occur in a mixture below this concentration. 


Regression Rate. The vertical burning rate, as a function of time that a pool of liquid burns. Useful in determining how 
long a pool fire may burn. Regression rate for jet fuels is 0.3 to 0.4 inches per minute. 


Stoichiometric. The ideal fuel air mixture where the ratio of fuel and air is such that all fuel will burn, thus giving the 
greatest energy release. 


Stratification. The non-uniform distribution of vapours in a closed or partially closed vessel. Molecular (chemical) weight 
of vapours, heavier than air, tends to cause the vapours to settle. At some distance above the surface of liquid 


it will be flammable whenever the fluid temperature is greater than the flash point. 


Upper flammable limit (UFL). The maximum vapour concentration at which propagation of flame will occur. 
Propagation of flame will not occur in a mixture above this concentration. 


Volatility. The tendency or ability of a liquid to vaporize. Volatility increases as the liquid is heated. 
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Chapter 12 


POWER PLANT INVESTIGATION 


12.1 GENERAL 


12.1.1 The power plant investigation normally includes the engine, the fuel and oil systems, propeller and its 
control unit, jet pipe, thrust reverser (as appropriate), mountings of the engine and, where the engine is built into a unit, 
the attachments of the unit to the airframe structure, firewalls and cowlings, auxiliary gear box, constant speed drive unit, 
engine and propeller anti-icing system, engine fire detection and extinguishing systems and power plant controls. 


12.1.2 Power plant failures or malfunctions are often causal factors in aircraft accidents. For this reason it is 
essential that a careful examination of the power plants and their associated components be made to determine whether 
they are involved as a causal factor in the particular accident under investigation. Careful collection of samples of all 
aircraft fluids and system quantities needs to be recorded as quickly as possible because these can become 
contaminated or leak. Section 12.7 provides guidance. 


12.1.3 In most cases a complete or even partial strip or teardown of either a piston or turbine engine will not be 
possible at the scene of the accident; indeed, with modern complex engines, this is most undesirable. This should only 
be attempted when very small and simple types of engines are concerned and where absolutely necessary. 


12.1.4 Only a superficial examination should be attempted at the site of the accident, paying particular attention to 
those items of control or fuel feeds connecting the engine to the airframe. Photography should be freely used and colour 
photography is useful where in-flight oil leakages and/or fire are suspected. Photographs of propeller ground scars and 
the intakes and exhaust of jet engines may provide information on engine operations at ground impact. This information 
can be easily contaminated or obscured if not rapidly documented. 


12.1.5 It is most helpful and indeed necessary with modern and complex engines to enlist a suitably qualified 
engine maker’s representative in the investigation team, preferably someone who has experience of aircraft accident 
procedure and techniques. If this is not possible an experienced technician with considerable experience in 
maintaining/overhauling the engine in question should be enlisted to assist in the power plant investigation. 


12.1.6 After a preliminary study on the site of the accident, arrangements should be made to transport the power 
plant to an appropriately equipped base for further tests and detailed examination/teardown. If available, an approved 
maintenance organization would be preferred to conduct such testing and examination. 


12.1.7 Always consider whether the engine can be tested on the airframe under controlled conditions or bench- 
tested, before stripping or removing any accessory. Such testing should be done with caution not to further damage the 
engine or airframe and not to cause harm to personnel involved in the testing. 


12.1.8 The investigator must, before removal of any engine from the scene of an accident, determine, so far as 
the wreckage will permit, if the engine was producing power. In addition to the foregoing examination it is just as 
important to establish that the engine is properly connected to a source of fuel and oil and that the appropriate fuel 
valves are correctly set, the pipes and lines clear of obstruction and the fuel and oil tank clean and unobstructed, not 
only outlets but inward air vents as well. The throttle connections should be examined for correct connections and the 
ignition (if piston engine) checked from the switches to the distributor. Many accidents have arisen from dirty and 
obstructed fuel, hydraulic or oil filters which have caused a loss of power. 


Il-12-1 


Il-12-2 Manual of Aircraft Accident and Incident Investigation 





12.2 GAS-TURBINE ENGINES 


12.2.1 The gas-turbine power plant normally consists of the total propulsion system, which includes the engine 
(see Figure IIl-12-1), as well as the nacelle and pylon system. The total system may include pumps, controls, generators, 
firewalls and fire detection and suppression systems associated with the power plant installation. 


12.2.2 The propulsion system has continued to gain in reliability as well as complexity with the development of 
large bypass turbofan engine installations. Because of this increased reliability there is a reduced likelihood of it being 
involved as a direct causal factor in accidents. However, a minor malfunction of this system may be coupled with human 
error in the accident chain. For this reason it is important to consider any anomaly of the power plant and what influence 
it may have had on crew actions in the particular accident under investigation. Even with no specific findings of a 
malfunction, the examination of the power plants themselves is often significant when establishing the overall factors of 
impact with the ground such as roll and pitch angle. 


12.2.3 In most cases a trained gas-turbine accident investigator will be able to ascertain both the pre-impact 
condition of the power plant as well as the circumstances of the orientation of the aircraft in an impact with the ground. 
This is typically performed on-scene and should always be documented as such by photographic evidence. 


12.2.4 Should there be any evidence of a power plant system malfunction or anomaly, arrangements should be 
made to transport the affected systems, as assembled, to an appropriate base for further teardown or strip to establish 
its causes. It is beneficial that experts with experience in investigating causes of such anomalies be present at such 
strips or teardowns. 
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Figure Ill-12-1 A typical large transport engine 
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Organization 


12.2.5 All power plant accident investigators will find that following checklist items ensures both a speedy 
assessment as well as a more diligent assessment of the propulsion system in an accident. The checklists provided in 
this document are intended to help power plant specialists in organizing their efforts on-site and to give guidelines for the 
investigation of specific areas and scenarios. 


What to do at the site 


12.2.6 Upon arrival at the scene, conditions permitting, the investigator should locate the power plants and 
proceed to assess potential issues such as in-flight fire, uncontained rotor parts and the visible condition of the entrance 
and exit stages of the engine. The investigators should use standard evaluations of fire evidence (whether ground pool 
fires or in-flight stream fires). They should familiarize themselves with the engine model relative to potential flammable 
fluid sources and they should work together with other investigating groups in order to establish if consequential fire 
damage is present on aircraft structures. 


12.2.7 The examination for potential uncontained rotor parts is critical because it evidences both an in-flight power 
loss as well as a potential source of consequential fire and/or aircraft damage. This portion of the examination may be 
short if there are no ruptures to the engine casings, but much more detailed if the engine casings have been ruptured by 
ground impact loadings. In the latter case, which is common, the investigator may rely on personal experience of having 
reviewed previous events where uncontained engine failures had occurred. This experience is supplemented by the in- 
service incident investigation experience and comparison with historical photos that may be available. 


12.2.8 The examination of the entrance and exit stages of the engine is made on-scene to assess the probable 
power capability and condition of the engines at the time of ground impact. This assessment is constantly reviewed and 
updated as new information becomes available from within the investigation, including inputs from other groups. 


12.2.9 The reason for assessing the power capability of the engines is initially to establish if an unexpected power 
loss may have occurred. Then there are the more subtle pointers that may be available to indicate a deviation 
concerning flight phase and anticipated crew action. For instance, if the investigation is postulating a low power condition 
such as normal approach, it would be important to be able to confirm this by examination of the engines. 


12.2.10 The examination and assessment of the power capability considers both the evidence of what power 
condition was present at ground impact, as well as an assessment of whether the engines were capable of developing 
normal power prior to ground impact. Some difficulty may be expected due to the crushing of the soft nacelles structures 
against the engine face that may partially obscure portions of the blading. 


12.2.11 If the blading has been damaged by either ingestion damage or an internal engine failure, the assessment 
can be obvious. However, if no such damage is evident, the examination must consider if the engine case structure has 
been crushed against these visible rotor stages and, if so, what damage it has produced to the blading. Evidence of 
damage around the complete circumference of the rotor typically confirms a high power condition, while local buckling 
and splaying of the blades suggests a low power condition. 


12.2.12 Caution must be taken when the engines have been separated from the aircraft during ground impact, as 
tumbling of the engines is likely. If this has occurred, the crushing damage of the engine cases against the rotors may 
occur at either the front or back of the engine, or at both ends but at different times. Since the front and rear stages are 
connected by a common shaft, crushing damage, first against the front stages at high power, may seize the engine such 
that the damage at the rear turbine stages appears to have occurred at low power. 


Ill-12-4 Manual of Aircraft Accident and Incident Investigation 





12.2.13 Even lacking any contributing involvement of the engines in an accident, other engine-related findings may 
be helpful if a violent aircraft upset is considered. In such a scenario, it is possible that the engines, while operating at 
power, may have been violently moved about their axis and by doing so, produced significant gyroscopic loads on the 
large diameter fan rotors. The evidence of this event may be seen by on-site examination of the blades and the engine 
casing. 


12.2.14 Finally, although this discussion has suggested key examinations which can be or are often performed in 
the on-site examinations by the engine investigators, it is important to realize that one of the greatest services that an 
expert provides is to see evidence which looks out of place or doesn’t fit expectations and then to check all findings until 
it can be resolved to the simplest investigation focus. 


Where to begin 


12.2.15 The checklists below detail what are the main tasks of the power plant specialist in the first stages of the 
investigation. It should be noted that the engine investigation is part of the overall investigation plan, so close 
coordination with the other investigation groups is necessary. The first task for the power plant investigator at the crash 
site is to make an inventory of power plant components, as listed below. 





Basic need-to-know 
— What thrust power was being commanded 
— What thrust power was being produced 
— What malfunctions occurred 
— What were the indications to the crew 








Overall investigation plan 

a) Inventory of components 
b) Maintenance and material records 
c) Photography 

— As found 

— Disassembly 
d) Field examination 
e) Recovery 
f) Laboratory teardown 








Inventory of power plant components 
— Inlet 
— Nacelle (including reverser where applicable) 
— Fan 
— Compressors 
— Burner 
— Turbines 
— Exhaust 
— Externals 
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How far to proceed 


12.2.16 It has been anticipated that during the investigation the power plant specialist will be checking for engine 
malfunctions by following the preceding checklists. Once the basic need-to-know questions have been answered, then 
the investigator should also assist the other groups such as Structures in assessing the engines for impact attitude with 
the ground against their pitch and roll axis as mounted to the aircraft. If earlier findings have found evidence of an engine 
malfunction, then it would be prudent to organize a follow-up plan to cover items e) and f) as part of the Overall 
Investigation Plan. If the engine is felt to be in the causal chain, then potential factors need also be considered. 
Examples of these are: 





For engine non-containment 

— Was there a source of flammable fluid? 

— Was there an ignition source? 

— Was there a fire? 

— Was there collateral damage to other systems? 

All of the above should be documented and commented on. 














For in-flight fire alone 

— What was the flammable material? 

— What was the ignition source? 

— How effective was the fire extinguishing system? 

All of the above should be documented and commented on. 














For power loss 

— Did itinvolve multiple engines? 

— What were the crew actions? 

— _ If crew actions were inappropriate, what training did the crew 
receive? 

All of the above should be documented and commented on. 
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External damage 


12.2.17 The first and most obvious inspection at the scene of the accident is for visible damage and whether this 
damage is consistent with the crash impact or whether it existed before impact with the ground. 


12.2.18 Generally, impact damage should be apparent to the investigator. Crash impact damage will cause inward 
crushing of the engine casings or tearing off of accessories, whilst in-flight failure such as compressor or turbine 
catastrophic failure can cause external penetrations with parts of the compressor or turbine being ejected from the 
engine and penetrating the engine nacelle and/or adjacent airframe. These indications are of an initial and general 
character and no conclusions should be drawn at this stage of the investigation. 


12.2.19 Of immediate interest to the overall investigation of the accident is the understanding and characterization 
of differences in damage between multiple power plants on the aircraft. These differences may be associated with the 
causal factors of the accident itself but are typically associated with the pitch and roll attitude of the aircraft as it struck 
the ground (see Figures III-12-2 and III-12-3). 


Power at impact 


12.2.20 It is important to know whether the engine was under power when it struck the ground. This is not always 
easy to assess and no straightforward or quick formulas are available to assess this at the scene of the accident. 


12.2.21 The investigator should be prepared to perform an initial assessment of the operational capability of the 
engine early in the investigation. Such an assessment is usually of great help to other members of the overall 
investigation to focus their efforts. These assessments are made by consideration of the visible evidence to the front and 
back stages of the engine. Thus if obvious high speed damage has been incurred to either the front or back stages 
(connected by the same drive shaft) a strong suggestion of available power at impact is available. However, a finding of 
low speed damage at impact is not definitive without further examination. 


12.2.22 In some instances the fact that the engines were under power or not at impact is easy to determine. 
Figure IIl-12-4 shows a fan rotor that had a high degree of rotational energy on impact while Figure IIl-12-5 represents a 
fan rotor not under power on impact, but possibly rotating under windmilling conditions only. Figure II|-12-6 illustrates a 
fan rotor which sustained high speed damage and subsequent low speed damage at impact. These photographs are, 
however, examples of quite evident conditions. In most instances, particularly in the absence of a surviving flight crew or 
of indications of engine power from flight recorders, several factors must be taken into account and examined before an 
assessment can be made. Such assessments can only be approximate and no viable technique exists where an exact 
power or rpm of an engine can be given because, in the absence of a recorder, there are so many variable and unknown 
factors to be taken into consideration. There are, of course, occasions where the engine casing is not damaged so no 
distortion of blades or rubbing of compressors appears to assist the investigator. The lack of visual rotational damage is 
not, therefore, immediate evidence of low power. The circumstances of crash impact, pilot actions before impact, setting 
of bleed valves, variable vane positions, speed of impact, nature of impact terrain or water, etc. must all be considered. 
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Figure Ill-12-2. Angle of impact effects 
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Figure Ill-12-3. Roll angle effects 
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Figure Ill-12-5. Low speed damage 
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Figure Ill-12-6. Low speed impact superimposed on high speed damage 


12.2.23 As stated before, it is important also to consider the causes of damage variation between the front and 
back stages of an engine. In cases where the engines are dislodged from the aircraft before they impact the ground, the 
engine may tumble so as to make contact with the ground with the aft turbine section rather than the fan section. The 
initial contact often results in crushing of the engine casings against the internal rotor blades causing the affected rotors 
to seize. Thus when the other end of the seized rotor ultimately contacts the ground, the rotor blades will already be at 
very low speed. 


12.2.24 The previous example of high versus low speed damage imprints will not necessarily apply to impact into 
water. Under this impact condition significant uniform hydraulic forces may be applied to the front stage of an engine. 
The significance of these hydraulic forces must be taken into account in conjunction with the possible engine rotational 
speed. If the engine rotational speed is high, then the blading will attempt to pump the water and result in significant 
bending forces against rotation resulting in complete fracture of almost all blades near their root attachments. This final 
effect is similar to a high rotational impact with the ground. 


12.2.25 In the event of low rotational speed during a water impact, where water is forced into the engine inlet, the 
hydraulic forces will act on the front face of the blading, forcing the blading backwards in an easy-wise bending mode. 
This easy-wise bending is actually bending perpendicular to the chord of a particular blade section. Since the blades 
themselves have a specific design shape, including twist as well as significant chordal stiffness changes, the resulting 
hydraulically deformed shape will often look like a “Z”-bend (see Figure Ill-12-7). 


12.2.26 Also to be considered are these same hydraulic forces acting against the casings of the engines. For 
mostly frontal impacts, the large area of the face of the casing absorbs the impact by twisting and then tearing. Most 
often, the final shape of the damaged casing will be similar to a twisted pretzel (see Figure IIl-12-8). 
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12.2.27 It should be noted that critical differences in either the blading damage or the casing/inlet damage from that 
described above may indicate an impact with the water other than a frontal one or that the engine was significantly 
shielded from the entrance of water into its face (see Figure Ill-12-9). 


12.2.28 In the assessment of engine performance at impact, the power plant specialist's goal is to estimate the 
thrust available. However, the evidence that is most available is the rotational damage, which can be considered more or 
less proportional to the rotational speed of the engine at impact. One factor that makes the rotational damage often 
misleading evidence is the relationship between rotational speed and thrust. The relation between these two parameters 
is not linear and the difference in high rotor rpm per cent between flight idle and maximum thrust is relatively small. In 
modern engines, the flight idle setting (no thrust) is at about 60 per cent rpm, so the rotational energy is sufficient to 
cause a heavy rotational damage at impact even if no thrust was available. 





Figure Ill-12-7._ Z-bending to the front stage blading superimposed over severe 
in-flight high speed failure damage (FOD battering) 
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Figure Ill-12-8. Pretzel-shape of the front cases of an engine after a frontal water impact. 
Note that the cases have been stripped off the engine by the hydraulic forces. 
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Figure Ill-12-9. Water impact damage. There was no frontal ingestion of water 
into the fan blades and the fan was at very low speed. 


12.2.29 There are other techniques that can assist the investigator in assessing the availability of power at impact. 


a) If the engine was functioning at impact, some dirt or wood may be ingested deeper in the engine or in 
the bleed air duct than in the case of a dead engine. If the soil is caked or the wood is burned, a 
reasonable assumption would be that the engine was working at impact. The airflow within a 
windmilling engine will cool the internal parts rather quickly, so the particle that may be ingested by a 
failed engine at impact will not appear as burned. 


b) The investigator should also gather any information available through the analysis of engine controls, 
instruments and accessories that can give an indication of the condition of the engine at impact. 


c) Engine throttles are often displaced by impact forces, but impact marks on the pedestal can help in 
determining their original position. 


d) Electromechanical engine instruments in the cockpit can give some hints on engine performance at 
impact. Modern power plants with electronic thrust control may include non-volatile memory devices in 
engine control computers which preserve data even if power supply is lost. 
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e) Variable inlet and stator guide vanes are controlled according to the engine setting and their position 
should be documented. The angle of the vanes can be reconstructed directly if witness marks are 
present on the engine case or indirectly through the analysis of the actuator. Bleed valve position 
should be compared to valve scheduling to estimate the engine condition at impact. Fuel metering 
units should be examined as witness marks or other impact damage may reveal their position at 
impact. Fractured accessory drive shaft should be analysed to determine if the fracture was caused by 
an accessory failure leading to a disconnect at the design shear point or if the shaft sheared at impact. 
Fuel and hydraulic pumps, constant speed drives, generators and any other accessory with rotating 
parts will show rotational damage depending on the engine power at impact. 


f) A number of systems are closely connected to the engine and a failure scenario should be verified 
taking note of the possible effects it could have on other systems. The reconfiguration of the systems 
by the flight crew according to abnormal/emergency checklists may suggest which type of failure they 
were facing. 





Checklist for high or low speed 


— Blade airfoils 
High speed if broken into small pieces 
Low speed if complete in length 


— Splaying or bending of blades to either side 
Low speed 


— Spiral bending in one direction 
High speed 


— Blasted appearance to airfoil edges 
High speed 











Types of engine failures 


12.2.30 The following material illustrates critical elements to look for at the accident site to determine if an engine 
failure has occurred. Most failures are obvious and it is left to the engine teardown to determine the origins and reasons 
for such failures. The following photos illustrate some examples of possible structural failures. There are other structural 
elements which may be involved as either a primary cause, such as a shaft or bearing failure, or completely secondary 
in nature such as rotor seizure loads causing distortion of case or nacelle structures. 


12.2.31 In almost all cases of engine failure not associated with fuel starvation, there are cause-effect relationships 
between the initiating cause and secondary damage. Migration of internal debris as loose particles downstream, and in 
some cases even upstream, is common and the effects of damage on the operating temperatures of the engine must 
also be considered. If the compression system is significantly affected, then the engine efficiency and exhaust gas 
temperature (EGT) will be affected as well. The higher speed turbine is very critical to the burner pressure. If this turbine 
is significantly affected, then the flame may actually migrate back out of the burner and begin to melt the low speed 
turbine stages further downstream. On the other hand, if the low speed compressor or fan is significantly affected, the 
flame may only migrate back into the high speed turbine and melt the tips of those stages. 
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12.2.32 Thus if evidence of overheat can be found in the turbine stages, always look at the compressors as well for 
the initiating cause. If the crew takes early action to shut down the affected engine then no evidence of an overheat may 
be obvious. 


12.2.33 In some cases the damage initiating in the low or high pressure sections of the turbine reduces their 
respective compressor driving speed, resulting in a mismatch in speeds between the compressor sections and thus 
initiating a stall/surge that can be heard and seen by witnesses (see Figure Ill-12-10). A stall/surge is also likely to 
happen if the damage initiates in the compressor or in the fan since damage may affect the internal aerodynamics. 
However, it is important to distinguish witness reports of flames and/or bangs out of an engine which could have been 
caused by a stall/surge due to an aircraft upset and air distortion in the engine inlets. 


Uncontained rotor disk fracture 


12.2.34 An uncontained rotor disk failure in a large gas turbine engine is one of the most energetic and potentially 
catastrophic of all propulsion system-caused failures. It is important that it is recognizable from purely crash impact 
damage. The following figures illustrate classic evidence of an uncontained rotor failure. 


12.2.35 Figure Ill-12-11 illustrates typical uncontained rotor-disk fragments from a compressor while 
Figure IlI-12-12 illustrates typical battering and escape trajectory marks to the vane stator rows on either side of the 
rotor-disk position in the engine. 


12.2.36 Figure IlIIl-12-13 illustrates a typical uncontained fragment penetration hole. Since the released parts are 
initially moving tangentially to the inner-most engine casings, the resulting hole will appear as a tangentially made 
squeeze tear with pursed lips along the circumference. 


12.2.37 Since the purpose of the investigation involves assessing all hazardous conditions for the passengers, it is 
also important to include a documentation of all uncontained part trajectories that may affect the cabin or additional 
aircraft systems. This is often performed by running strings or tapes between the holes in the engine casings and 
corresponding holes in other parts of the aircraft (see Figures III-12-14 and III-12-15). 





Checklist for uncontained rotor burst 


— Outward bulging of surrounding cases 

— Long tangential holes or splits 

— Heavy battering to vane stator rows on either side 

— Missing stages 

— Engine internal parts outside engine or along the flight path 
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Figure Ill-12-10. Flame out inlet and tailpipe in an engine stall/surge 





Figure Ill-12-11. Example of ruptured compressor rotor disk 
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Figure Ill-12-13. Squeeze-rupture penetration hole 
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Figure Ill-12-14. Uncontained fragments trajectory lines 





Figure Ill-12-15. _Uncontained rotor disk fragments trajectories 
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Operational ingestion 


12.2.38 Foreign Object Damage (FOD) caused by the ingestion of small objects such as gravel, rivets or lock wire 
is a common initiator in the compressor section. 


12.2.39 Often small objects are able to pass through the fan leaving little evidence of damage. The fan and the first 
stage of the compressor may show a clear imprint of the ingested object which can give some indications of the origin of 
FOD. The object can also leave microscopic traces on the damaged zone and a spectrographic analysis of the particles 
can determine the composition of the object. 


12.2.40 If ingested into the core engine, objects may pass easily through the low pressure compressor stages 
without leaving much damage. However, when the particles try to enter the high pressure turbine they are often battered 
for long periods of time by the inlet stage to this rotor due to its high speed. Nicks and gouges left by the FOD should 
have little effect on the engine except in the rare cases where tips of the small blades in the back of the compressor are 
severely damaged. As pointed out earlier, any loss of compressor tip air flow over a large circumference will result in 
severe overheat of the turbine if the engine continues to run. However, if the smaller nicks in the blades are not detected 
and repaired over numerous engine operation cycles they are likely to develop into fatigue cracks and release large 
debris to cause an engine failure. 


12.2.41 Among the many sources of ingestion into a large engine fan capable of causing FOD, the most 
noteworthy are those that are likely to affect multiple engines on the aircraft. These objects are birds, ice and volcanic 
ash. The first two ingestion causes are likely to result in what is known as soft-object cascade damage to several 
consecutive blades in the fan rotor. Soft-object damage is caused when a relatively soft object (including ice) is sliced 
into segments by the spinning action of the fan blades. The result is to leave similar bends, cusps and twisting damage 
to one or more consecutive blades in a rotor. It is important to distinguish this damage from the random battering or 
gouges resulting from metallic pieces which can be released from a single blade that has been damaged. 
Bird ingestion 
12.2.42 With any source of multiple engine ingestion into transport engines, it is important to also investigate the 
environmental sources of the ingestion as well as to document its effect on the engine. As examples, for bird ingestions 
into multiple engines, the investigation should consider documentation of all bird strikes across the face of the aircraft 
(see Figures Ill-12-16 and Ill-12-17) as well as the bird species, flock size and the environmental attractants that were 
present at an airport as applicable. 

Examples of such investigations may include: 

a) bird species (weight and maturity); 

b) time of day; 

c) birds’ activity (feeding, lounging or transiting); 

d) previous recent history at airport, as applicable; 


e) distributions of birds across aircraft face; and 


f) distributions across engine face. 
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Figure Ill-12-16. Examples of bird strike locations on aircraft 


12.2.43 A useful means of confirming multiple bird strike locations on the aircraft and engine face would be the use 
of an ultraviolet light. This process can also be used for other animals and wildlife, such as deer. 





Checklist for possible bird ingestion 


— Cascade damage to consecutive blades 

— Soft cusps/bends/dents/twists 

— Down/breast feather tufts caught in crevices behind fan 
— Feathers or staining in engine ducts including bleeds 
— Unusual smell in fan discharge 

— Aircraft strikes across leading edges or landing gear 
— Ignore blade tears or gouges 
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Figure Ill-12-17. Bird ingestion damage 
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Figure Ill-12-18. Ice ingestion ripple damage 


Ice ingestion (See Figures III-12-18 and IIl-12-19.) 


12.2.44 


For possible ice ingestion, investigations should consider all potential sources such as: 


a) 
b) 
c) 
d) 
e) 
f) 


g) 


h) 


radome ice; 

wing ice; 

fuselage ice; 

inlet ice; 

engine nose spinner ice; 

fan blade icing; 

internal icing; 

taxiway/runway ice (includes adjacent plowed areas); and 


slush adhered to gear. 
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Checklist for possible ice ingestion 


— Cascade damage or random damage to consecutive blades 
— Soft cusps/bends/dents/twists 

— Blade leading edge ripples 

— No evidence of bird feathers/tufts 

— Nosmell or odour in fan discharge 

— Possible dents on leading edges 

— Ignore blade tears or gouges 














Figure Ill-12-19. Dents in acoustic treatment due to ice released from fan rotor 
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Volcanic ash/dust ingestion 


12.2.45 The ingestion of the small particles associated with volcanic ash or dust is classically different in the 
damage it produces in today’s high performance gas turbines. The obvious effects of erosion to the rotating blades are 
typically not a serious threat to the safety of the flight. However, more serious effects typically occur in the very hottest 
station within the engine, namely the inlet nozzle vanes to the turbine. This is because in modern engines at cruise 
conditions the turbine inlet temperatures are very likely to melt concentrations of dust, which subsequently adhere to the 
narrow air passages associated with the nozzle guide vanes. Any changes to the airflow at this critical point in the 
engine are very likely to affect the stability of the power plant to operate without exceeding temperature limits or running 
down on its own (see Figure II|-12-20). 
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Figure IIl-12-20. Volcanic ash melted and adhering to hot section parts 


Ill-12-24 Manual of Aircraft Accident and Incident Investigation 





Nacelle and reverser system failures 


12.2.46 Other power plant failures may include the nacelle and reverser systems. The nacelle system failures have 
for the most part consisted of dislodgement of cowling panels from their attachments either from uncontained engine 
failures or from the primary failure to secure the locks after maintenance. In newer transport aircraft models the relation 
between the nacelle and the engine is complex and the tracing of cause-effect relationships involving this interaction 
typically requires designer/installation expertise. For example, many of today’s large high-bypass engines depend on a 
degree of load-sharing by the nacelle to react against engine bending and/or seizure loads. Thus if a catastrophic engine 
failure were involved, a large degree of nacelle damage may be expected beyond that attributable to just holes from 
uncontained particles. 


12.2.47 Other primary nacelle systems failures may include the reverser system. The investigator should 
reconstruct the position of the reversing devices at impact by analyzing the actuation system and the impact damage 
near the reverser. In particular, if a part normally shielded by reverser panels is damaged and the corresponding panel 
isn't, this suggests that the reverser was activated at impact. 


12.2.48 The complexity of the reverser system rivals the complexities of the engine’s digitalized fuel controlling 
systems. Some critical points to consider are: 





Power plant systems interaction 


For all lines of defence which include redundancies or barriers, 
determine: 


— Iflatent failures were present; and 


— If one failure of defence also caused another failure 
(dependency). 











Other engine failures 


12.2.49 Additional common causes include turbine blade failure due to wearing out through operation at very high 
temperature conditions. More severe turbine failures may occur due to shaft fractures brought on by internal oil fires or 
misassembly (see Figure IIl-12-21). 





Primary shaft fractures 


— Measure for disk growth to confirm 
— Blade fractures with uniform circumferential lengths 
— Possible rotor disk or seal fractures from over speed 
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Figure Ill-12-21. Shaft fracture 





Secondary shaft fractures 


— No appreciable rotor disk growth 

— Non-uniform blade fractures throughout 
— Evidence of severe inter-shaft rubbing 
— Possible fatigue to bearing supports 

— Aircraft reports of continued vibration 











12.2.50 Less common but far more catastrophic are rotor disk fractures or high pressure case fractures between 
the compressor and the turbine (see Figure III-12-22). Even less common in accidents is oil or bearing problems since 
they are often only discretion items requiring the shutdown of a single engine without affecting safe flight. 


12.2.51 Engine accessory failures are becoming less frequent in accident causal chains. Examples of serious 
failures involve gear train failures, disabling the control functions of the engine, fuel or oil supply and, in even rarer cases, 
of the fuel control system. If any of these systems are suspected then the manufacturer should be consulted. 
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Determination of malfunction of gas turbine engines 


12.2.52 While catastrophic engine rupture is the most obvious visual evidence of a pre-impact failure, there are 
numerous other malfunctions that can result in power loss or symptoms requiring the pilot to shut down an engine. It is 
not the purpose of this document to cover all possible causes of engine malfunctions but rather to provide examples of 
evidence of malfunctions that may be available at the accident site. It is strongly recommended that any indications of an 
engine malfunction found at the accident site be confirmed as to underlying causes by removing the engine to a place 
where adequate tools for a strip teardown are available. However, it is typically not necessary to perform an off-site strip 
investigation unless positive evidence of an engine malfunction has been determined during the on-site examination. 


12.2.53 With the term malfunction we are referring to any combinations of engine-induced symptoms that either 
result in a power loss or are likely to require the crew to shut down the engine (see Table Ill-12-1). Some symptoms 
such as engine surge/stall may be only temporary in nature and as such are not covered here as malfunctions. 
Generally the symptoms of most interest and their causes are combinations of symptoms e.g. fire warning, power loss, 
vibration/noise, abnormal indications in exhaust gas temperature (EGT), oil temperature or oil pressure. The most 
common cause of these symptoms arises from gas path distress of some sort, generally associated with the rotating 
components. 





Figure Ill-12-22._ High pressure case fracture 
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Table Ill-12-1. Engine malfunction symptoms’ 
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Fire Warning Oo; Oo O X 
Visible flame o|;0o0;,0;0 xX | O 
Vibration xX |O/;}X |O Xx Xx 
Yaw 0o;0;0;0;,0;0); 0 
High EGT xX |X} oO] 0 xX OoO|x/|0O 
N1 change X|X|/O;O0;X}]X |X X 
N2 change X|X|O);0O0;xX|]X | xX X 
Fuel flow change xX | oO; 0 OoO;xX)}/0O;}090 
Oil indication change xX |O} 0 O | X O 
Visible cowl damage X | X O X 
Smoke/odour in cabin Oo Oo; Oo 
bleed air 
EPR change xX |X |X );/O;xX}]X | X X 
X = Symptom very likely O = Symptom possible 
Note.— Blank fields mean that the symptom is unlikely 
12.2.54 Pre-existing damage may not generate symptoms to the crew. Such evidence would be nicks and tears in 


the blading caused by the ingestion of small stones or gravel. However, any evidence of significantly increased tip 
clearances over a compressor or turbine rotor stage should be interpreted as significant damage likely to have resulted 
in a combination of symptoms requiring crew action. Examples of such damage are shown in Figures Ill-12-23 and 
Ill-12-24. 





1. Extracted from Airplane Turbofan Engine Operation and Malfunctions — Basic Familiarization for Flight Crews, Engine & Propeller 
Directorate, Federal Aviation Administration, 2000. 


Ill-12-28 Manual of Aircraft Accident and Incident Investigation 








Figure Ill-12-23. Increased tip clearance caused by fan tip rub 





Figure Ill-12-24. Increased tip clearance caused by overheat 


Part Ill. Investigation 
Chapter 12. Power Plant Investigation Ill-12-29 





12.2.55 It is also recognized that evidence of significant internal damage may not always be visible from a cursory 
external examination of the engine at the accident site. From an internal inspection, it is possible to infer that serious 
internal damage is present by probing for evidence of the following: 


a) Metal-In-Tail-Pipe; 

b) metallization in the hot section; and 

c) titanium fire in the compressor. 
Metal-In-Tail-Pipe 


12.2.56 Metal-In-Tail-Pipe (MITP) is caused by particles of pulverized metal beads that have passed through 
successive rotor stages, emanating from the release of metal blade fragments further upstream. Often these beads of 
metal may be felt with the hand by reaching into the tailpipe and wiping the hand over interior flange areas behind the 
last stage of the turbine. The interpretation of MITP should not be confused with the much larger broken pieces of blades 
that have occurred from impact with the ground. 


Metallization 


12.2.57 Metallization is the melting of the blade tips against their surrounding cases due to friction and the 
depositing of this material on blunt surfaces farther downstream in the hot section (see Figure Ill-12-25). This depositing 
is a valid finding either as a negative or positive for confirming an internal engine failure under power. The evidence of 
such deposits can be confirmed by borescope examination of the burner dome or the leading edges of the turbine inlet 
vanes/blades. Visual evidence of metallization appears as a salt and pepper crystalline appearance. 


Titanium fire 


12.2.58 Titanium fires are metal fires which depend on an oxygen-rich environment and high bulk temperature rise 
of the metal itself. Both conditions are typically present in the rearmost compressor section in modern gas turbine 
engines. However, the metal still needs a source of ignition to start the process. This source is commonly present when 
metal parts are liberated and significant sparking occurs. Whilst most metals resist this ignition source, titanium does not. 
These conditions usually only occur if large amounts of metal are liberated at high power deep within the compressor 
section. Thus the occurrence of a titanium metal fire is not in itself a causal factor but rather an indicator of a failure that 
has preceded it. 


12.2.59 Titanium compressor fires are readily visible by the evidence of oxidation, with severe colorations or bluing 
of the metal case surrounding the initiating compressors stage as well as torch-like local burn-through (see 
Figures II|-12-26 and Ill-12-27). 


Fire 


12.2.60 Power plant-related fires, other than titanium fires typically involve the space between the engine and the 
nacelle, where a number of fuel and ignition sources are present (see Figure Ill-12-28). Some engine utilities are 
actuated using fuel as a hydraulic fluid. If an engine fire is being investigated, all fuel lines around the engine should be 
checked for leaks to verify if they contributed to the event. Bleed air leaks may set off a nacelle overheat or even a fire 
warning. The investigator should verify if the crew correctly identified the cause of the warning and reacted accordingly. 
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Figure Ill-12-26. Titanium fire damage (note arrowhead effect) 
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Figure Ill-12-27. Titanium fire burn-through 





Figure Ill-12-28. Nacelle fire 
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Tailpipe fire” 


12.2.61 Tailpipe fire occurs when fuel puddles in the turbine casings and exhaust during start-up or shutdown, and 
then ignites. This can result in a highly-visible jet of flame out of the back of the engine, which may be tens of feet long. 
Passengers have initiated emergency evacuations in these instances, leading to serious injuries. There may be no 
indication of an anomaly to the flight crew until the cabin crew or control tower draws attention to the problem. They are 
likely to describe it as an “Engine Fire,” but a tailpipe fire will not result in a fire warning on the flight deck. If notified of an 
engine fire without any indications in the cockpit, the flight crew should accomplish the tailpipe fire procedure. It will 
include motoring the engine to help extinguish the flames, while most other engine abnormal procedures will not. Since 
the fire is burning within the turbine casing and exhaust nozzle, pulling the fire handle to discharge extinguishing agents 
to the space between casings and cowls will be ineffective. Pulling the fire handle may also make it impossible to dry 
motor the engine, which is the quickest way of extinguishing most tailpipe fires. 


Effectiveness of fire extinguisher systems 


12.2.62 In many aircraft accident investigations, witnesses will state that they observed the aircraft on fire prior to 
impact. The actual occurrence of in-flight fire is relatively rare. The majority of witness-reported fires are observations of 
brief flashes of flame from the engine because of a stall/surge in the compressor. The majority of crew-detected in-flight 
fires are due to major mechanical breakdown or disruption in the power plant and the release of free fuel into the engine 
bay. Providing the correct drills are taken promptly, most fires can be brought under control and extinguished in flight. 
The most important part of the fire drill is to shut off the flow of fuel to the engines: this is normally the low pressure fuel 
supply from the tanks. If this part of the drill is carried out promptly and correctly, the fire will generally extinguish itself. 
Fire extinguisher systems rely to a large degree on the associated drills being carried out quickly and in correct 
sequence. In turbine engines the low pressure fuel must be shut off, and kept shut off, before the fire extinguisher 
system can be effective. 


12.2.63 Special techniques may be necessary after a major fire accident to determine whether the fire extinguisher 
bottle cartridge was operated by the crew electrically. Cross-over or second-shot systems also involve two sets of power 
plant fire extinguishers and it is essential to check both systems to ascertain whether the correct heads have been 
discharged in both systems. 


12.2.64 Another method, if circumstances permit, is to analyze electro-chemically the inside of the discharge or 
spray pipes and nozzles to ascertain whether the chemical extinguishing agent has passed through the system. Fire 
extinguisher systems and fire warning systems are becoming complex and specialized and the prompt cooperation of 
the manufacturer is essential to a successful investigation into any fire extinguisher system. 


Flame-out 


12.2.65 The predominant cause for in-flight flame-out of modern turbine engines is the malfunction or failure of the 
fuel supply or control regulator. If the fuel controller or pumps are suspected and conditions permit, rig testing on a 
controlled rig is the best method of determining the cause of malfunction. The re-light system should also be examined. 
The investigator must always bear in mind that flame-out of turbine engines can be caused by mismanagement of the 
fuel system, including turning off the wrong fuel valve, leaving a fuel valve open to an empty tank or simply running out 
of fuel. All of these matters should be examined and eliminated before concluding that the engine equipment was at fault. 





2. Extracted from Airplane Turbofan Engine Operation and Malfunctions — Basic Familiarization for Flight Crews, Engine & Propeller 
Directorate, Federal Aviation Administration, 2000. 
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12.2.66 There continues to be some confusion about the use of the word flame-out. This confusion is in the 
language differences used between the pilot reports and the engine designer. The following summarizes common uses 
of the word by these two parties. 


a) Flame-out according to the crew (common report) 
— Loss of response to throttle 
— Spool down of rotor speeds 
— EGT increasing to an overtemperature 
— Commonly associated with a stall/surge 


b) Flame-out according to the engine designer (rare) 
— Loss of response to throttle 
— Spool down of rotor speeds 
— Burner blow out (flame goes out) 
— EGT decreasing 


12.3. PISTON AND TURBINE/PROPELLER ENGINES 


12.3.1 A different technique is required to determine if a piston or turbine/propeller engine was under power at 
the time of impact. Here again a lack of power may appear to be obvious at first inspection (see Figures III-12-29 to 
Ill-12-33) and the propeller may even be feathered but this is not conclusive evidence of lack of power available at the 
engine. Accidents have been caused by crew mistakenly feathering the “good” engine instead of the defective one, so 
propeller examination must also go along with engine examination. Again it is very unwise to try and conclude power 
output of a piston, or turbine/propeller engine at the scene of an accident. Engines and propellers should be taken to a 
capable workshop or laboratory for expert examination or, at the minimum, a technician with experience in maintaining 
that engine type should assist in the examination of the engine. 


Determination of malfunction or failure of piston engines 


12.3.2 In determining failure or malfunction of a piston engine any evidence received from eyewitnesses should 
first be considered in order to localize the type of failure involved. The following most common symptoms of engine 
malfunction and their causes are listed for information. The fact that several of these symptoms are similar should 
forewarn the investigator of the possibility of assigning wrong causal factors if a careful physical examination is not 
performed. 


Carburettor icing 


12.3.3 This is experienced more frequently with small piston engines than with the larger piston engines which 
usually have injector systems that are less prone to icing. Carburettor icing is usually indicated by a gradual decrease in 
power, sputtering, erratic increases and decreases in rpm, intermittent rough operation, exhaust often emitting black 
(over-rich mixture) smoke. In some engines carburettor icing will occur when the relative humidity is fairly high (above 60 
per cent) in fine, sunny and often warm weather (15/20°C — 60/70°F). (See Figure III-12-34.) It must be borne in mind 
that conditions for airframe icing need not prevail for carburettor ice to form. The investigator must study the 
meteorological conditions and assess these conditions with findings from the wreckage i.e., the setting of the hot and 
cold air intake valves or shutters both at the engine and cockpit. Checks should be made for possible failure of the 
shutters themselves or disconnection of the control. 
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Figure Ill-12-29. Metal propeller windmilling at impact 





Figure Ill-12-30. Metal propeller under power at impact 
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Figure Ill-12-32. Metal blades 3 and 4 of the previous propeller 
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Figure Ill-12-34. Carburetor icing probability (Source: Research at Transport Canada) 
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Ignition trouble 


12.3.4 Ignition faults are often indicated by intermittently rough operation of the engine. Electric harness, magneto 
wiring to the cockpit switches, magneto drives and timing are all points worthy of inspection. The spark plug points may 
be very revealing and may indicate other troubles such as incorrect mixture or abnormal lead deposits. The investigator 
must check that the type of spark plug is appropriate and that the plugs are tight in the cylinders. The investigator must 
also check that the fuel was the correct grade for the engine, etc. 


Running out of fuel or fuel starvation to the engine 


12.3.5 This is often indicated by sputtering or erratic increases and decreases of power but, on occasion, 
depending upon the type of carburettor or fuel injection system, there may be no audible or noticeable warnings except a 
silent fading away of the engine. On multi-engine aircraft, especially when flying on instruments or at night and where 
constant speed propellers are in use, failure may be difficult to detect for some time. Fuel pressure and fuel flow meters 
give the most reliable indication of fuel starvation causing an engine loss of power. Incorrect fuel valve setting or fuel 
system mismanagement particularly on multi-engine aircraft has caused more accidents than running out of fuel in the 
normal sense. The investigator must ensure to record all fuel valve settings as found in the wreckage whether they seem 
relevant or reliable or not. Electrically controlled valves normally give reliable pre-crash indication of the last setting of 
the valve. Cable or rod operated fuel valves may move during the crash impact or during rescue and salvage attempts 
and this type of control should therefore be viewed with suspicion as to reliability of pre-crash setting. 


12.3.6 Inspection of fuel tanks, pipe lines and fuel vents is essential to ensure that obstruction, leakage or chafing 
or punctured or corroded tanks did not exist. The investigator must check back to the last refuelling source and inspect 
the relevant documents. Storage and usage of the aircraft together with fuelling practice may require examination for it is 
possible for water condensation to collect in tanks and carburettors. 


12.3.7 Strip inspection of fuel injectors and carburettors should be performed by specialists at a suitable base or 
laboratory. Points to remember during this investigation are proper size of jet installed, sticking or punctured float, 
cleanliness, corrosion of jet wells, foreign matter in the fuel chamber, evidence of water and the correct settings of 
mixture and throttle controls. With injectors, the control valves, cut off and pump must be carefully inspected. With both 
injector and carburettor systems it is often better to rig test first, if this is physically possible, rather than strip; this also 
applies to such items as fuel pumps. Precautions should be taken to ensure that evidence of any possible contamination 
is not lost when initiating functional testing. 


Lubrication 


12.3.8 Often it will be obvious if lack of lubrication has played any part in the failure, but in some engines oil 
pressure from the normal engine system is used for other purposes such as servo systems, oil heating of carburettors, 
feeding propeller control units, etc. Oil systems therefore must be examined from tank to engine for obstructing dirt, 
loose or failed pipes, leakages, etc. The correct quantity and quality of oil should not be forgotten. All oil filters should be 
examined with great care and, if necessary, chemically analyzed. Chemical analysis is a technique employed to control 
failures and to detect any divergence from correct specification or impending failure. Many major operators conduct 
chemical analysis as a normal maintenance procedure. A trend analysis of the metal and contamination contents in the 
pre- and post- accident samples may indicate the cause or the sequence of development of the component failure. 
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Mechanical integrity 
12.3.9 With the exception of very small and simple piston engines, it is recommended that strip examinations be 
undertaken at a capable engine overhaul or investigation base. The manufacturer should be consulted at an early stage 
because the manufacturer’s experience and background knowledge of defects and failures is invaluable to the success 
of the investigation. The investigator should normally be sufficiently qualified to supervise the strip investigation. If not, 
then an experienced power plant technician should participate as an adviser. Any suspicious fractures or failures should 
always be examined by an expert in fracture analysis or by a qualified metallurgist. Fatigue is the usual type of failure in 
connecting rods, gear teeth, rockers, and camshafts, cylinder hold down studs, pistons, springs and crankshafts and is 
usually well and typically defined at the fracture surface. 
Indications of high power in reciprocating engines 
12.3.10 a) Drive shaft 
— Torsional displacement; 
— Shaft sheared; and 
— Engine splines offset; 
b) Significant internal damage; 
c) Gear teeth stripped; 
d) Rotating parts machined; 
e) Counterweight clamp shifted; 


f) Severe impeller damage; and 


g) Bending of exhaust stacks (hot). 


Indications of low power in reciprocating engines 
12.3.11 a) Drive shaft; 


— No torsional damage; and 
— May be bent from impact but not sheared; 


b) Little or no internal rotational damage to: 
— Reduction gears; 
— Accessory drive gears/shaft; and 


— Supercharger impeller; and 


c) Brittle fracture of exhaust stacks (cold). 
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12.4 EVIDENCE OBTAINABLE FROM PROPELLER EXAMINATION 


12.4.1 When properly correlated with evidence obtained from the engine, examination of the propeller can 
produce valuable evidence such as: 


a) revealing whether power was being produced at time of impact; 
b) rpm of the engine (in some cases); 
c) propeller blade angle; and 


d) ground speed of the aircraft (in some cases). 


Examination of blades 


12.4.2 The first step in propeller examination is to account for all the blades, particularly the integrity of the tips. If 
any portion of the blade is missing, the fractures on the recovered portion should be examined with a magnifying glass to 
determine whether the break occurred in flight or at impact. Evidence of fatigue or tension breaks should be carefully 
noted. 


Determination of rotation at impact 


12.4.3 The next step should be an examination to determine whether the propeller was rotating at the time of 
impact. The most typical indications are as follows: 


a) blades bent opposite to the direction of rotation; 


b) cordwise scratches on the front side of the blades. It is almost impossible to produce a scratch that is 
exactly perpendicular to the edges of the blade unless the blade was turning at the time; 


c) similar curling or bending at the tips of all blades. (See Figure Ill-12-35.) It is almost impossible to 
damage the tips of all blades in a similar manner unless the propellor was turning at the time; 


d) dings and dents to the leading edge of the blades; and 
e) torsional damage to the prop shaft or attachment fitting; 


12.4.4 It must be remembered that the propeller in all probability was turning at impact. Even if the engine failed 
or was shut down, the propeller will windmill at an rpm high enough to produce these indications of rotation. The 
exceptions to this are: 


a) the propeller was feathered. If this occurred, the propeller will, of course, show no signs of rotation; 


b) The propeller was not feathered, but was completely stopped due to either internal failure (seizure) of 
the engine or aerodynamic stall of the propeller. If the engine seized internally there will be clear 
evidence of that. The aerodynamic stall theory involves shutting down the engine and then slowing the 
aircraft down to the point where the propeller stops windmilling. This is difficult to do. It is generally 
necessary to hold the plane near a full stall while waiting for the propeller to stop. 
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Figure Ill-12-35. Propeller tip bent forward as a result of high rpm during a low-angle impact 


12.4.5 When a non-feathering propeller is involved it should be expected to have been rotating at impact. Finding 
evidence of rotation does not say much. Finding absolutely no evidence of rotation should however lead the investigator 
to suspect massive internal engine failure. 


12.4.6 However, a word of warning — the investigator in the field must treat with great reserve the damage and 
distortion seen in propeller blades after they have struck the ground. It is all too easy to reach a hasty conclusion that an 
engine had been under power when the accident occurred because the propeller is greatly bent or damaged. Evidence 
adduced from examination of the propeller blades will normally be correlated with other evidence before it is possible to 
form a proper conclusion. 


12.4.7 What can the propeller damage tell us about engine power output? Not much unless there are propeller 
strike marks that will allow the investigator to calculate rpm. Many investigation texts will suggest that if the propeller tips 
are bent backward, the rpm was low. If they are bent forward, the rpm was high. This is very misleading. 
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12.4.8 What actually happens is that the tips of the blades as they strike the ground may bend either forward or 
backward depending on the relationship between rpm and forward velocity. This is a simple exercise in forces. The prop 
blade is not straight, but is twisted forward at the blade pitch angle. If the rom is high compared to the forward velocity, 
then the dominant force tending to bend the blade is the blade pitch angle and it tends to curl the end of the blade 
forward. On the other hand, if the rpm is low compared to the forward velocity, then the dominant force on the blade 
comes from the forward velocity. This tends to curl the end of the blade backward. Therefore, the curling of the blade 
end is not a direct measurement of rpm. The rpm might be high, but if forward velocity is also high, the blade tips are 
likely to curl backwards. If the tips are curled forward, it is clear that the prop rpm was not only high in relation to the 
forward velocity, but the propeller was being driven under positive power from the engine. Other issues need to be kept 
in mind regarding this phenomenon. First, it occurs only at the blade tips and it appears as a curling starting with the 
leading edge corner of the tip. A blade bent at mid-span, either forward or backward, is not an indication of high or low 
rpm. Second, it occurs on all blades. If only one blade is bent, it was caused by something else; not rotation. Third, this 
only occurs at relatively low angles of impact: five degrees or less. This phenomenon is most commonly interpreted 
following gear-up landings. If the pilot had no idea that the gear was up until the screeching sound was heard, then the 
blade tips will be bent back; the engine was near idle power. If, on the other hand, the pilot realized at the last moment 
that the gear was up and shoved the throttle full forward to go around, the blade tips will be bent forward. 


12.4.9 As a precaution against the loss of important evidence, it is a good practice to mark the position of the 
blade shank with respect to the propeller hub, but where the drive between the blade and the pitch change mechanism 
is severed as a result of impact, the significance of these marks will have to be assessed during detailed inspection. 
Many factors must be taken into consideration, and each accident assessed accordingly. The angle of impact, the nature 
of the ground, speed of impact, the material of the propeller be it aluminium alloy, steel or wood, all influence the 
assessment. In short, it is not sufficient to examine a propeller by itself and then assess whether or not the engine was 
under power. The propeller blades form only one link in the chain of evidence, which, when coupled with other features 
such as pitch angle of the blades in relation to the known phase of operation at the time of the accident, the twisting, if 
any, in the propeller shaft and the condition of the engine and fuel valves, etc. may lead to sounder conclusions 
regarding the degree of engine power being developed at the time of impact. Determination of the pitch setting may be 
ascertained by stripping the propeller governor head and checking the position of the pitch change mechanism in 
conjunction with impact markings or impressions often made across the base of the blade on the soft copper shims or 
packing plates. The markings or impressions can give valuable and reliable clues as to the pitch angle of the blades at 
the time the blade strikes the ground. This work must be done with care in conjunction with an expert from the propeller 
manufacturer or other skilled person experienced in this type of investigation. 


12.4.10 Wooden blades under power loading will shatter and their pieces will be scattered a considerable distance 
either side of the path made by the aircraft. 


12.4.11 Propellers which are feathered on impact may, depending upon the nature of the crash, leave distinctive 
line markings on the ground in line with the path of the aircraft. Rotating propellers leave characteristic slash marks at 
short intervals or spacings upon which certain calculations can be made (see 12.4.3 below). In the case of propellers of 
some light aircraft which are operated by governor oil pressure against a spring or compressed air, it does not 
necessarily follow that if this type of propeller is found in the feathered position that the propeller was feathered prior to 
impact. In some circumstances these propellers can run into the feathered position after impact. 


12.4.12 It should always be remembered that evidence of lack of engine power on impact as shown by the 
propeller does not necessarily imply engine failure since the pilot may close the throttle of an engine, or turn the 
switches off before impact if in a position to do so. 
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12.4.13 The spacing of the initial cuts or bites of the blades of a propeller in the ground (see Figure IIl-12-36) may 
provide useful evidence particularly if the ground speed of the aircraft at impact is known (or can be estimated). The 
following formulas may be used to determine approximately the propeller speed in revolutions per minute at the time of 
impact with the ground: 


Where: 


D = Distance in feet between scars 


V = Ground speed 


N = Number of blades 


If there is reduction gearing the engine shaft speed can be obtained by inversely applying the reduction gear ratio to the 


proper speed. 


Determination of propeller rpm or aircraft ground speed at impact 


Vkts x 101.3 
rom = ——_—_—— 
DxN 
Vmph x 88 
rpm = 
DxN 
Vie rpmxDxN 
101.3 
Wik rpmxDxN 
88 





Figure Ill-12-36. Propeller strikes on a runway 
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Propeller failure in flight 


12.4.14 Accidents have occurred due to blade failure in flight, usually as a result of fatigue cracks. Such failures 
cause excessive vibration and frequently the engine is torn out of its mountings or the reduction gear casing is torn from 
the engine. Propeller failure in flight may not originate in the propeller itself and careful examination of its controller, oil 
system, engine and reduction gear is essential. 


Foreign object damage (FOD) induced fatigue 


12.4.15 During operations, propellers frequently encounter conditions susceptible to FOD. Small nicks, scratches 
and gouges introduce stress risers which, left unattended, may result in fatigue cracks. Blending small defects is a job 
left to professional mechanics and, as such, should be well documented in the propeller log. Excessive defect size, 
inadequate blending, or excessive blending can lead to propeller failure. Depending on the dynamic flexing of the 
propeller, simple marks by a pencil may introduce a scratch of sufficient depth to induce fatigue. 


Resonance failure 


12.4.16 All engine and propeller combinations have operational regimes that introduce harmonic vibration. 
Operator's handbooks usually identify these areas as rpm to avoid for prolonged use or torque values to avoid. 
Resonance is the excessive vibration caused by this harmonic relationship. Fatigue failure is the normal result of 
resonance. (See Figure IIl-12-37.) Unlike FOD-induced fatigue, resonance will normally not demonstrate a fatigue origin 
related to pre-existing damage. Also, investigators should examine the other propeller blades for similar fatigue. A 
resonance failure will affect all blades similarly although one blade will usually fail before the remaining blades. If the 
fatigue failure location is measured from the hub, similar fatigue may be found at the same distance on the remaining 
blades. This examination may require non-destructive examination with dye-penetrant or similar methods. 


Overspeeding of propellers 


12.4.17 Overspeeding propellers, which have defied attempts by the flight crew to feather them, have also been a 
factor in accidents. Failure of the reduction gear may in some installations uncouple the propeller and the free spinning 
propeller may overspeed violently due to windmilling to such an extent that blades may be flung out of the hub under 
enormous centrifugal forces. Very often the only resource the flight crew have of controlling an overspeeding or run- 
away propeller is to close the throttle and raise the nose of the aircraft in order to reduce the airspeed. 


Failure of propellers to feather 


12.4.18 Investigative authorities and industry representatives have been quick to blame failure-to-feather accidents 
on the failure of the pilot to follow emergency procedures — specifically, failing to feather the propeller on the failing 
engine, which will normally preclude the aircraft from maintaining level flight. A common thread in most accident 
investigations involving un-feathered propellers is the absence of any inquiry as to whether the failure of the propeller to 
feather and the ensuing accident were due to a mechanical, rather than an operational, cause. In other words, could the 
feather mechanism have failed to operate despite the pilot's efforts? 
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Figure Ill-12-37. Propeller showing beach rings as a result of resonance fatigue failure 


12.4.19 One propeller where this has been demonstrated during research is of the constant-speed and full- 
feathering type. It is a single-acting unit in which hydraulic pressure opposes the forces of springs and counterweights to 
obtain the correct pitch for engine load. The propeller is feathered by removing the hydraulic pressure from the piston 
when commanded by the pilot. This is accomplished by dumping the pressurized oil to the crankcase. There is a 
centrifugal latch group in the propeller that allows the propeller to be held in the low-pitch condition when the engine is 
shut down to aid in the restart of the engine. 


12.5 POWER PLANT MANAGEMENT 


12.5.1 The power plant investigator, assisted by specialists from other investigation groups, should verify if the 
flight crew managed the power plant appropriately. Two possible scenarios are presented here as examples. 


a) An accident occurred when the crew of a multi-engine aircraft mistakenly shut down a functioning 
engine following an engine malfunction warning; and 


b) Today large transport aircraft often take off with a thrust level less than the maximum take-off thrust to 
preserve the engine and extend its life. The thrust setting is calculated according to a number of 
parameters, including the take-off weight, the runway length, elevation and slope, local pressure and 
temperature. If the engines are incorrectly set at a lower thrust than necessary, the aircraft may be 
unable to perform a safe take-off even with no engine malfunction. 
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12.6 TYPE AND QUALITY OF FUEL 


12.6.1 Jet engines are not normally very sensitive to the type or quality of fuel and most engines are approved to 
run on several types or grades of fuel, such as kerosene, petrol mixtures or even, during emergencies, pure petrol. Fuel 
is normally well controlled for quality at the refuelling base before the aircraft is re-fuelled and it is rare for failures or 
accidents to occur due to poor quality of fuel in turbine engines. However, there have been cases where the fuel has 
degraded inside contaminated fuel storage tanks, either in the aircraft itself or in airport storage tanks. 


12.6.2 The investigator should always record the type and quality of the fuel used, obtaining a chemical analysis 
report if considered necessary. This is particularly important when fire/explosion occurs. 


12.7 COLLECTION OF SAMPLES 


12.7.1 The main purpose of taking samples is to identify substances found on aircraft components, and to assess 
the bulk or main fuel or oil supply against the correct specification. Care should therefore be taken to ensure that the 
sample reflects the average characteristics of the fluid. Sometimes in aircraft accident investigation this is not always 
possible and often difficulty will be experienced in obtaining a sample at all. 


12.7.2 Taking samples of oil from the power plant and fuel from the main tanks or power plant should always be 
attempted. Clean and uncontaminated containers must always be used. Fuel samples should be in suitably sealed tins. 
(Glass or plastic containers let in light which may spoil the sample; fuel may also absorb some of the constituents of the 
plastic.) At least 2 Litres (0.5 gallons) should be obtained if a proper assessment of fuel is to be made in a laboratory. 
The containers should be clearly labelled with aircraft number, date, and position of sample taken. There should be no 
delay in getting samples to the laboratory. 


12.7.3 Taking samples of other materials such as smoke or soot smears may be justified. Contaminants or 
smears on compressor blades should be subjected to chemical analysis in the laboratory in the interest of determining 
the possible source, e.g. bird or other foreign particle ingestion. 


12.7.4 It is quite common to remove chip detectors in the oil system to look for evidence of bearing failures as an 
initiating cause. Also the use of borescope plug examinations is extremely useful to confirm on-site the possibility of an 
internal failure. At the time of these examinations the investigator should also consider if any of these inspection ports as 
well as oil caps may have been left off by previous maintenance. 


12.8 SPECIALIST EXAMINATION 


12.8.1 Fuel and oil samples must be examined by fuel and oil specialists to the relevant specifications. Some of 
the contaminants that may be found in the oil system are metallic or carbon-particles, foreign fluids and sludge. The 
metallic particles may be ferrous or non-ferrous. Ferrous particles indicate some failure of steel parts within the engine 
and the size and shape can give a clue as to what failed. The most probable sources of steel shavings are bearings, 
seal faces and gears. 


12.8.2 Non-ferrous particles usually indicate failure of sleeve bearings, bushings, pistons or some other 
aluminium, magnesium or bronze part of the engine. 
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12.8.3 Excessive sludge or carbon may cause fuel starvation and engine failure. Foreign fluids such as water or 
fuel are not prevalent in the oil system, but their presence, if excessive, will change the lubricating qualities of the oil and 
cause trouble in the engine. Another possible cause for engine failure is using the wrong type of oil which can cause 
serious internal fires and engine malfunction. Consequently, a detailed physical and chemical analysis of the fuel and oil 
and any contaminants in these systems can be most useful. 


12.8.4 Testing of power plants, accessories or instruments, if possible, should always be considered in preference 
to primary strip inspection. This should be clearly indicated from the start and all such items clearly labelled. Very often 
the complete power plant cannot be bench tested but many of its accessories can and these should be removed for rig 
testing. A substitute for bench testing can often be found by mounting the engine on a similar airframe and this may 
expedite the investigation. 


12.9 OTHER SOURCES OF INFORMATION 


12.9.1 The power plant investigator can obtain useful information about the operating condition of the engine from 
a number of data storage devices. If the accident causes the destruction of the aircraft, many of the devices will be 
damaged and data retrieval may be impossible. However, the power plant specialist may be called to investigate an 
incident that leaves the aircraft almost intact. In this case, the data should be readily available. A borescope is a useful 
tool to inspect the internal conditions of an engine. A specialist in performing borescope inspections should be called to 
assist the investigation team and to perform borescope inspections of engines. 


12.9.2 Along with dedicated data recording devices, modern aircraft are equipped with electronic systems that 
contain memory devices designed for data storage. Most commonly, such systems contain a type of volatile memory 
device whose data is lost when power is removed. Frequently, systems contain a memory device known as non-volatile 
memory (NVM), which is capable of retaining its stored data even though power has been removed. The recovery of 
NVM devices can be extremely difficult and time-consuming as they don’t generally carry any distinctive marking to 
facilitate identification. 


Flight data recorder 


12.9.3 The number of parameters recorded in the flight data recorder (FDR) has increased noticeably in the last 
decades and modern solid state FDRs have made the retrieval and analysis of data easier and quicker. 


12.9.4 The power plant specialist should obtain the engine parameters readout as soon as practical to verify if the 
data available fits in the hypothetical failure scenario. A chart comparing the parameters from different engines on multi- 
engine aircraft helps in highlighting any difference in engine performance. 


Quick access recorder (QAR) 


12.9.5 Along with the compulsory FDR, many large transport aircraft have other voluntary recorders installed to 
help in the diagnosis of failures and facilitate maintenance. These recorders, commonly known as Quick Access 
Recorders (QAR), can store many times the parameters available in the FDR but they are not hardened against impact 
or water and fire damage. The investigator should seek technical assistance from the manufacturer to retrieve all data 
available. 
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Aircraft Addressing and Reporting System (ACARS) 


12.9.6 To facilitate aircraft maintenance, many large transport aircraft have on-board automatic systems that send 
data on aircraft systems, including engine parameters, during the flight. The company's technical centre receives the 
data through a VHF communication network known as Aircraft Addressing and Reporting System (ACARS). Since the 
data is stored, it should be possible to get some information about the accident flight. 


Electronic engine control unit 


12.9.7 Modern engines are electronically controlled through a dedicated computer, known with different names, 
including Full Authority Digital Engine Control (FADEC), Electronic Engine Control (EEC) or Engine Control Unit (ECU). 
This system is not hardened against crash damage and it is not intended to provide accurate data in case of an accident, 
but in the absence of FDR information, any data retrieved from the engine FADEC may be helpful in providing some 
information about the last minutes of flight. However, the FADEC memory is designed for engine maintenance 
troubleshooting purposes and the “time stamp” indicating when faults occurred versus when they were written to 
memory is of poor resolution for accident investigation purposes. 


12.9.8 Use of NVM information from FADEC-equipped engines in accident investigation requires expert 
assistance in the recovery, readout and analysis phase. Positive identification and assignment to a specific engine 
position is important. Expert care must be taken during recovery to prevent any accidental electrical discharges which 
could corrupt the memory. No in-situ or bench tests should be attempted without the direct assistance of the FADEC 
designer as such bench tests often erase the memory during the initial readout. 


12.9.9 Fundamentally the purpose of the FADEC is to control the engine and not the aircraft. It is self-powered by 
the engine and uses environmental information such as aircraft speed, pressure-altitude and temperature provided to it 
by aircraft systems. Should there be a loss of environmental information available or a malfunction, the FADEC will 
revert to back-up modes. When a fault is sensed by the FADEC, a time stamp is recorded on the NVM along with basic 
engine and environmental data. It is therefore quite common for the NVM to record minor faults of any kind throughout 
the accident flight or even previous flights. 


Cockpit Voice Recorder 
12.9.10 The Cockpit Voice Recorder (CVR) can be a useful source of information for the power plant investigation. 
Warning alarms in the cockpit help in defining the failure scenario and the event timeline. Cockpit crew voices and 


sounds resulting from the operation of switches can give some information on the performance of the appropriate engine 
failure checklist. A sound spectrum analysis can provide an approximate estimate of the rotational speed of the engines. 
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Chapter 13 


SYSTEMS INVESTIGATION 


13.1 GENERAL 


13.1.1 The Systems Investigation Group covers investigating and reporting on those systems of the aircraft which 
are not included under other headings. Generally, the following systems are considered to fall under the heading of the 
systems investigation: hydraulics, electrics and electronic pneumatics, vacuum, pressurization and air conditioning, ice 
and rain protection, instruments, air data computer, flight director, stall warning and recovery, radio communication and 
navigation systems, autopilot, fire detection and protection system, oxygen system. There is inevitably a degree of 
overlap, as for instance in the case of hydraulically operated flying controls where the power generation and regulation 
of the hydraulic system constitutes part of the systems investigation whilst hydraulic operation of the control surfaces 
comes within the coverage of the structures investigation. 


13.1.2 The aircraft systems investigation presents a somewhat difficult task owing to the diversity and complexity 
of modern equipment. Therefore, since all systems and their operation can be related to three basic areas, it is 
imperative that the investigator have a good working knowledge of hydraulics, electricity/electronics, and pneumatics in 
order to adequately develop and analyze the available facts. Investigators should be cautious when working with these 
systems, especially during accident site inspections, as many contain fluids or gases under pressure or have electrically 
charged elements that can be discharged resulting in serious injury or death. 


13.1.3 Investigators should avail themselves of appropriate detailed schematic diagrams or working drawings to 
determine what components are included in each system, then make every effort to account for all of these components. 
These diagrams or drawings will also be helpful in analyzing the effect of a malfunctioning component on the remainder 
of a system. 


13.1.4 The examination of the system will generally involve more than examination of components. It can involve 
the functional testing of a complete system, the testing of individual components of a system, or re-installation of 
equipment in an aircraft of the same type for flight tests to determine the capabilities of the components in normal flight 
and under conditions specified by the investigator. Data developed by the examination of one system may be helpful in 
proving or disproving the integrity of other systems. 


13.1.5 Each system can be broken down into six areas which should assist in accounting for components. These 
areas are (1) supply, (2) pressure, (3) control, (4) protection, (5) distribution and (6) application. Documentation of 
components should include nomenclature, manufacturer, part number, serial number and, where provided, the 
specification number. Some components having the same part number may be used in various places in the same 
system, especially in the hydraulic and pneumatic systems. Therefore, it will be necessary to obtain a current listing from 
the operator showing the location of components in the system by serial number. This information may be obtained from 
the manufacturer. 


13.1.6 Documentation of the systems and components should not merely consist in cataloguing or listings. Rather, 
it should comprise a fairly detailed description of the appearance and condition of the components as well as the position 


of any movable parts. Complete sentences should be used rather than terse, cryptic phrases. 


13.1.7 One of the first items to be documented should be the positions of switches and controls in the cockpit 
wreckage. An investigator must, however, keep in mind that position of switches may have been altered during search 
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and rescue activities and/or fire fighting. Readings on all available instruments should also be documented. Such 
documentation, supplemented by photographs, should be accomplished as soon as possible and in co-ordination with 
the Operations Group. Other members of the investigating team should be asked to stay out of the cockpit area until the 
documentation has been completed. 


13.2 HYDRAULIC SYSTEMS 


13.2.1 The hydraulic systems on many modern aircraft are essential for flight. Most large aircraft have at least two 
independent hydraulic systems. These control systems usually have separate pumps and hydraulic reservoirs supplying 
either redundant flight control actuators or so-called dual actuators. Dual actuators can be designed to function as a 
tandem or parallel effort, and be hydraulically independent of each other. In a hydraulic system failure, the affected 
control element has an integral control valve system that goes into “by-pass.” This allows the functioning system to 
maintain uninterrupted control without impedance from the empowered section. 


13.2.2 Even multi-engine, multi-system aircraft have had occurrences in which a single catastrophic failure has 
led to the loss of all hydraulic systems. While the probability of this is extremely remote, designers have now 
incorporated flow valves which sense an unrestricted flow of fluid which would indicate an open line downstream. These 
valves then close and/or reroute the flow thus allowing continued use of the system elsewhere in the aircraft. In 1989, a 
DC-10 operated by United Airlines (UA232) near Sioux City, lowa, USA, experienced a catastrophic number two engine 
failure from which shrapnel penetrated the two remaining hydraulic lines. These ruptured lines allowed unrestricted loss 
of hydraulic fluid which rendered all hydraulically driven flight controls unusable. While the recurrence of this combined 
failure was judged to be remote, it was decided to retrofit the model (and other multi-engine aircraft) with these flow 
valves to ensure the remaining engine-driven systems would remain available for aircraft continued flight. 


13.2.3 Investigators should obtain hydraulic fluid samples from as many sources as possible, e€.g., reservoirs, 
filters, actuators and trapped line sections. Ensure contamination does not occur during sampling. Probably the best 
samples are those taken from components which are capped and sent to a lab. Attempt to establish the system pressure 
at impact by analyzing pressure gauges, annunciator panels, etc. (See Instrument analysis, Chapter 13.6). Relate all 
readings to system operations such as ancillaries, multiple display modes, system pressure changes during normal 
operations and back-up systems. If it can be established that the system was operating at a normal pressure the 
investigator can concentrate on individual components rather than the system as a whole. 


Hydraulic fluids 


13.2.4 Samples of fluid should be obtained from various areas of the system for analysis and contamination count. 
The reservoirs should be examined to determine the quantity of fluid remaining and to determine the fluid level prior to 
the accident; check the reservoir drain valves for being closed and made safe, the fluid inlet filters for contamination, and 
the security of the filler neck cap. Fluid suction shut-off valves may be manually or electrically operated; check them for 
being open or closed and relate the findings to normal or emergency operation. 


13.2.5 During the late 1970s a rising concern with the flammability of hydraulic fluid led to the introduction of a 
“less flammable” hydraulic fluid. The fluid (MIL-H-83282), although not completely “fireproof,” had improved 
characteristics and is being used both in new designs and on a retrofit basis. On some aircraft this retrofit process is 
permitted on a mixing or attrition basis. The appropriate maintenance manual should be consulted to determine the type 
of hydraulic fluid which should be found in the aircraft which was involved in the accident. 
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Standard hydraulic fluid (MIL-H-5606) 


13.2.6 This is a mineral-base fluid which consists of high quality petroleum oil and is usually coloured red. 


“Fire resistant” hydraulic fluid (MIL-H-83282) 


13.2.7 This is synthetic hydrocarbon fluid which was developed to provide increased fire resistance, and was 
designed to be fully compatible with MIL-H-5606. However, not all systems are approved for MIL-H-83282 in spite of the 
design requirement. Certain cold weather characteristics of MIL-H-83282 have resulted in its restriction from use in 
some aircraft systems, especially if its operation requires arctic basing. In addition, the hydraulic system “O” ring seals 
and other internal materials must be compatible with MIL-H-83282 before it can be used. 


SKYDROL 


13.2.8 This is a typical fire-resistant fluid used in commercial aviation. These fluids are usually of the phosphate 
ester type. There are a wide variety of types and colours, light green, blue, purple, etc., for these fluids. Seals, gaskets, 
and hoses used with these fluids are made of butyl synthetic rubber or Teflon® fluorocarbon resin. The fluids are not 
compatible with MIL-H-5606 or MIL-H-83282. 


Reservoirs 


13.2.9 The reservoir contains the system's extra supply of fluid. Systems which do not use suction pumps are 
typically pressurized or have some other mechanical device to maintain a positive fluid supply to the pump. In addition to 
accommodating fluid exchanges due to thermal expansion, many hydraulic actuators, especially the larger ones, have 
unequal displacements when operating, i.e., a small displacement one way and a large one the other. 


13.2.10 An important task of the hydraulic reservoir is to maintain a positive head of pressure to the hydraulic pump 
suction port at all altitudes and for the full aircraft manoeuvering range. This is accomplished by using pneumatic, 
hydraulic, or spring pressures against the piston or in earlier designs, a flexible rubber diaphragm. A spring pressure 
effort against the back of the piston is particularly effective when a system is started when the bootstrap or accumulator 
pressurization is absent, such as after the hydraulic pressure is dumped to check the accumulator's nitrogen charge. 


13.2.11 Notice particularly the difference between a “closed” hydraulic system reservoir, using a bootstrap piston 
pressurizer, and an “open” reservoir system. The latter requires a method of ensuring a constant source of fluid to the 
pump inlet under all conditions of flight. In addition to applying a constant tank pressure, higher than atmospheric, a 
mechanical device must be provided that makes certain the tank outlet tubes are immersed in the fluid supply at all 
angles or positions of flight. Both systems have considerable merit. The “open” type system is not susceptible to the 
serious problems that develop in the “closed” type system if it is allowed to contain air. 


13.2.12 Hydraulic reservoirs are designed so that air is not introduced into the system. Investigators should 
examine the position of the piston within an intact reservoir to see if the quantity of fluid remaining can be determined. If 
the reservoir is separated or all fluid has escaped during the break-up, investigators should examine the reservoir walls 
to find witness marks that might indicate the level of fluid remaining at impact. 


Hydraulic pumps 


13.2.13 The main hydraulic pumps may be engine driven or electric driven; auxiliary pumps will generally be 
electric driven. Check the drive coupling integrity: examination of the fracture surfaces of a sheared coupling can provide 
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operational evidence. A battered and somewhat polished appearance of the mating fracture surfaces indicates that the 
coupling failed while the pump was being operated and the driving source continued to operate and the two surfaces 
were battered together. Clean and otherwise undamaged fracture surfaces would indicate that the pump and driving 
source were static at the time of failure. Such a failure would most likely be the result of crash forces. This condition 
would apply to any component operated in like manner. A pump with a sheared coupling and damaged fracture surfaces 
should be examined for lubrication, wear, looseness, or overheat. Examine the internal mechanism for evidence of 
overheat, cavitation or actual failure. Filters are installed in the case drain lines of some pumps and should be examined 
for trapped evidence of impending or actual pump failure. In addition to picking up the fluid from the reservoir, 
compressing it for energy delivery (pressurizing it), and responding to high or low flow requirements, some pump 
designs are further complicated. To improve engine starting characteristics, designers have added valves and speed- 
sensing pump sections that can cause the pump to remain unloaded until it reaches a specified rpm and conversely on 
shutdown. This is done to decrease loads during starting and shutdown. If a hydraulic pressure supply problem is 
suspect, an in-depth study of the pump system is needed. There are four variations of design of the pumps, described 
below. 


Continuous-flow pumps 


13.2.14 A continuous-flow pump operates at a pre-determined constant system pressure and at a constant flow. 
When system demands remain constant, as in a condition when no operational changes are made, the system uses 
bypass valves to bypass the system components and fluid returns to the reservoir and is recycled. As an operational 
need is made, a valve opens allowing fluid to enter the appropriate chamber for displacement. The continuous flow 
system is highly complicated, combining full pressure bypasses and an intricate valving system to provide near 
immediate response to the selected demand. 


Variable displacement pumps 


13.2.15 The flow for the variable displacement hydraulic pump is determined by the system’s demands. A regulator 
senses pressure drops and causes changes to be made to increase the output from the pump. The design of the pump 
has a series of small pistons in contact with a wobble plate. When the system detects the need for additional flow and 
pressure, the wobble of the plate increases with the demand resulting in greater travel of the small pistons to produce 
the desired results. When no demand is being requested by the system, the wobble plate is almost without wobble 
except for a token amount to circulate the fluid for pump lubrication and cooling. 


On-demand pumps 


13.2.16 On-demand pumps may be of constant flow or variable displacement design but provide pressure only 
when the hydraulic system is engaged. That is, when an operational requirement is made that requires hydraulic flow 
and pressure, the first system action is to start the pump. The system then responds either as a continuous-flow or a 
variable displacement type for as long as the hydraulic system is needed. Once the selected action or actions have been 
completed, and after a pre-determined delay, the system shuts down until needed again. For operation of the landing 
gear retraction or extension system, the landing gear handle is moved to the desired position, the pump starts, builds to 
pressure, valves then open to provide hydraulic pressure to the appropriate side of the actuator. The landing gear moves 
until it is in position, a positioning switch closes and the valve is returned to the “off? position. The pump runs for a short 
time then shuts off until demanded to operate again. 


13.2.17 On-demand pumps are normally electrically driven and may be placed anywhere in the aircraft. As such, 
they have a master operation selector switch in the cockpit which engages (or disables) the pump operation. A common 
malfunction of this system is for the pump to continue to run even after the demand has ceased. As these systems may 
be high-pressure systems, they rapidly build up heat and may fail if they run continuously. Catastrophic failure may 
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release hydraulic fluid under pressure in the proximity of electrical connections where a fire may be initiated. 
Investigators, therefore, should examine the on-demand pump as a source of a fire if evidence indicates fire in its 
proximity. Also, a failure of hydraulic systems to operate when demanded should have the selector switch position 
determined as the failure of the crew to engage the pump prior to demand would eliminate the normal operation of the 
system. This may be reported as a “hydraulic failure.” 


Suction pumps 


13.2.18 Some hydraulic systems, especially those on the larger aircraft, use suction pumps and accumulators to 
ensure a constant flow of hydraulic fluid to the main pumps. The great distance between the engine driven pumps and 
the reservoirs, plus the large volume of fluid required for many subsystems, dictate a need for boosted suction hydraulic 
fluid supply. These pumps are usually electrically operated, and a failure typically results in a minor impact on the overall 
system operations. Systems without suction pumps use pressurized reservoirs or other mechanical means to provide 
constant fluid flow to the pump's suction port. 


Hydraulic accumulators 


13.2.19 The hydraulic pumps or regulators cannot always react fast enough to satisfy large hydraulic flow demands. 
This can result in a diminished system pressure which is undesirable even if it occurs for only a very short period. 
Accumulators provide hydraulic energy during the initial moments of the increased system flow demand until the pump's 
variable flow mechanism can respond. A secondary benefit of accumulators is their natural ability to help dampen the 
high-frequency hydraulic pulses associated with most multi-piston pump systems. This feature can be most beneficial in 
reducing plumbing attachment and component fatigue failures due to some undesirable hydraulic dynamics. 


13.2.20 The accumulators contain both hydraulic fluid and nitrogen. When the system is operating normally, the 
pressure of the hydraulic fluid balances the nitrogen pressure, and the accumulator is in the state of equilibrium. 


Pressure regulators and relief valves 


13.2.21 Regulators and relief valves should be examined for sticking open or closed and they may be tested to 
determine their regulatory settings. These units may incorporate heavy springs and should only be disassembled by 
qualified personnel using proper equipment to avoid personal injuries. 


13.2.22 As arule the hydraulic pump system has its own maximum pressure regulation system. If this system fails 
to regulate or permits damaging high-pressure peaks, the aircraft's main pressure relief valve relieves and prevents 
system over-pressures. Normally the main relief valve is set higher than the pump's maximum pressure setting, so that it 
functions only in a pump delivery problem. A relief valve that is subjected to prolonged overpressures can show signs of 
overtemperature. High-pressure hydraulics passing through a small orifice or passage characteristically generates high 
temperatures and can cause the hydraulic system to overheat or to overwork the hydraulic fluid cooling system, if so 
equipped. 


Manifolds and pressure modules 


13.2.23 These distribution centers should be examined for the position of any incorporated selector valves. 
Pressure modules are usually controlled manually or by an electric motor. Their positions as found should be related to 
normal or emergency operation. Associated electrical connectors and wiring should be checked for security, installation 
and electrically caused damage. 
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Selector valves and actuators 
Selector valves 


13.2.24 Selector valves should be examined for position and integrity of control linkages. Some selector valves are 
operated directly from the cockpit by cables or pushrods. The position of such valves should be regarded with caution 
because aircraft break-up can pull the cables or break them thus rendering valve positions questionable. 


Actuators 


13.2.25 Hydraulic actuators can be simple in their operation or they can be complicated depending on their 
intended purpose. If the actuator’s purpose is to open or close a door, for example, pressure is either directed to the 
extend or retract ports on the actuator. There should be no in-between position. If variable displacement is required such 
as for flight control surfaces, the systems become a bit more involved. In these cases, when the crew member moves a 
control in the cockpit, an electrical or mechanical signal is sent to a metering valve mounted on the actuator. 


13.2.26 This detail is described to lead the investigator to areas where vital information may be obtained. It is 
common for impact forces to inflict impact damage or marks depicting the position of the ram or piston at the time of 
impact. If not firmly captured in position, this will most probably require sectioning (cutting open) the actuator. The 
actuator rod and linkage positions should be measured externally prior to internal examination so that both an outside 
reference measurement can be compared to any internal impact marks. The aircraft manufacturer should have charts 
correlating the dimensions (external and internal) to surface displacement. Once the actuator is sectioned, impact marks 
may be observed. Depending on the age of the actuator, the internal barrel may exhibit significant wear patterns. For 
variable displacement actuators, the most wear will be at the neutral or un-powered position. Moving away from this 
neutral position, the wear decreases until the normal limit of travel is reached. Most impact marks will lie between these 
two references. For accuracy use a ruler with 1/100-inch markings for measurements. Figure III-13-1 shows three types 
of actuators and the measurements available. The graphs illustrate the translation of measurements to control position. 


13.2.27 The proper connection of the actuator input rod and of the actuator to the control surface is critical, as is 
the connection of any electrical component. Any impact marks outside of this normal travel range should be evaluated 
cautiously. During impact break-up, surfaces may be driven beyond normal ranges or actuator mounts may be broken 
which might allow extension (or retraction) to move beyond normal. Such impact marks should be supported by other 
evidence before assuming the actuator was, in fact, at this position. Similarly, there may be a series of impact marks 
noted. Normally, the first mark in the direction of the final position is the position at initial impact. The others were 
probably due to the aircraft break-up sequence. 


13.2.28 Two factors are essential for using actuator positioning in investigative analysis. First, and foremost, the 
specific actuator must be identified! Aircraft manufacturers routinely use a common actuator in numerous locations. 
These actuators may be all working in concert to move a specific multi-location system or they may be operating 
completely different controls. When common actuators are present and the actuator is found detached from the 
surrounding surfaces or structure, it may not be easy to determine which actuator was operating which control. The 
second factor of importance is the relationship between the impact forces and the mounted position of the actuator. The 
impact mark will normally be in the direction of the impact forces. Ideally, the impact force is perpendicular to the 
actuator allowing a strong impact mark to occur. However, even oblique angle impacts leave evidence. The direction of 
impact is necessary to determine which side of the actuator barrel to section out. Laboratory evaluation of the actuators 
should be conducted by specialists. The investigator should include identification of the actuator as well as information 
on the impact attitude of the aircraft so that the specialist can determine the sectioning which most probably will reveal 
the initial impact marks. 
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13.2.29 The last caution is for the investigator to look for corresponding evidence in other actuators or surfaces. 
For example, if an aileron actuator is found to have an impact mark indicating the associated aileron surface was 
deflected down at impact, an actuator from the other side of the aircraft may exhibit an impact mark indicating its aileron 
surface was deflected upward. This type of confirmation adds reliability to the analysis. 
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Figure Ill-13-1. Evaluating actuator position 
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13.2.30 Once a flight control position is determined, the deflection of the control surface can be correlated to the 
aerodynamic effect. A specific deflection at a specific airspeed, for example, results in a predictable result. However, it 
should be remembered that a control surface that is not being commanded to deflect by the crew or a subsystem will 
normally return to a neutral position. No crew intent can be derived from a neutral position unless there is evidence 
available to indicate otherwise. 


Filters and by-passes 


13.2.31 Filters should be examined for the amount and type of contamination which may be present. The 
investigator should specially look for seal and gasket material and metal particles which might indicate impending or 
existing failure in some component. 


13.2.32 The filters keep the hydraulic fluid clean. The well-being of a hydraulic system depends on the absence of 
foreign material or contaminants. Those of sufficient size can interface or cause jamming of precision hydraulic 
equipment and units. Hydraulic filters can intercept materials and microscopic objects that would be harmful to hydraulic 
systems. Depending on their position and the components they are protecting, their filtering size is designated in 
microns. For example, flight control actuators usually require protection down to 5 microns or lower. As a rule, filters 
contain a bypass ability if they reach a point that they are blocking the designed flow. 


13.2.33 The acquisition, identification, and laboratory inspection of all system filters is of primary importance in 
hydraulic system mishap investigations. Identifying any materials found in the filters can provide leads to upstream 
component failures or contamination products. Once the filter starts to bypass, the contaminants are free to enter the 
operating components. Thus, contaminated hydraulic fluid may result in erratic operation of one component which is 
very sensitive to contaminants while other less sensitive components continue to operate normally. If at all possible, the 
filters should be located when hydraulic system malfunctions are suspected. 


13.2.34 It is not uncommon for a precision control valve or flight control actuator to contain its own screen or filter 
system. These should also be checked for contamination. 


13.2.35 The component filters should be checked by the agency performing the unit tear-down report. In fact, these 
agencies frown on field persons doing any disassembly of a unit which is to be evaluated. One usual shortcoming at the 
mishap scene is the lack of hydraulic fitting caps and plugs used to seal items destined for tear-down action. These 
should be part of the aircraft-type specific accident response kit. 


Hydraulic lines and hoses 
Hydraulic lines 


13.2.36 Depending on their function and application, hydraulic lines can be dural, corrosion resistant (CR) steel, 
titanium, or other materials. Dural lines are usually used for return pressure lines, unless the lines are installed in high- 
temperature areas. In this case, even return lines are made of steel. The changes in hydraulic pressure causes some 
flexing of the lines so they are mounted to the aircraft structure using special clamps which prevent movement but do not 
damage the hydraulic tubing. If tube support hardware and attachment clamps are not installed according to the 
technical order, line fractures or line chaffing can result. 


13.2.37 The integrity of the aircraft tubing is generally lost in a major ground impact. The redundancies built into the 
normal hydraulic power system usually prevent any problems involving loose or ruptured tubing from leading to a major 
aircraft accident, unless, of course, the fluid ignites. The number of incidents connected to single system plumbing 
failures seem to indicate that the built-in redundancy is performing as designed. The only deviation to this is when a dual 
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flight control actuator or valve that uses two or more hydraulic power systems fails. In a fracture or failure in an area or 
wall that is common to both systems, the so called redundancy is lost. In fact, if the aircraft possesses an emergency 
hydraulic power system, this too can be expected to dissipate and fail along the same path. 


13.2.38 Hydraulic plumbing maintenance and repairs are known to have been major “players” in aircraft mishaps. 
Local tube manufacture problems, incorrect metal substitutions, inaccurate tube bending making it necessary to force 
the tube into alignment, failure to replace original installation clamps, over- or under-tightening connections or installation 
errors resulting in a line chaffing against an adjacent structure or object can result in a high-pressure atomized hydraulic 
spray. Aircraft hydraulic tubing is routed, secured, and protected against chaffing but occasionally, because of 
maintenance actions, chaffing of hydraulic tubing against aircraft and engine components or adjacent objects occurs. 
This creates very small holes in the tubing, resulting in a very small but extremely high-velocity stream of escaping 
hydraulic fluid. The escaping hydraulic fluid is very flammable under these conditions, and should it contact a hot 
component such as those of the engine, a fire usually results. The fire is somewhat like a torch and has been known to 
quickly melt through heat-tolerant materials. 


13.2.39 Hydraulic lines and fittings should be examined for security, evidence of leaking and other evidence of 
failure which may have occurred prior to the accident. Also, check for improper installation, bogus fittings and improper 
tubing materials. 


Hydraulic hoses 


13.2.40 Hoses are used throughout the hydraulic system to connect the various components to the tubing network. 
Hoses are required to provide flexibility so that components can move, and also to isolate the components from vibration 
and other activities which preclude the use of fixed tubing. The hoses vary among aircraft, but typically have a Teflon® 
interior tube coated with a reinforced fabric rubberized surface which, in turn, is covered with a steel braid. The hoses 
may be factory assembled or they may be locally assembled by the hydraulic shops of a maintenance provider. Some 
hoses are preformed for specific applications. Substituting an improper hose where a preformed hose is specified can 
result in undesired hose stress and hose failure. 


13.2.41 Most hoses are connected to the aircraft tubing and components with permanent fittings. There are, 
however, components which are connected using quick-disconnect fittings. Quick-disconnect fittings are almost always 
used to connect the engine-driven hydraulic pumps to the aircraft system. The quick-disconnect fittings frequently have 
automatic shutoff features so a fitting can come loose without any significant loss of hydraulic fluid. If used in flight 
control plumbing, quick-disconnects may contain pressure-relief features that allow uninhibited operation of its dual 
control hydraulic feature in an accidental separation. The quick-disconnect fittings may be safety-wired in place, but 
more frequently they rely on an internal locking mechanism to maintain their integrity. Other connectors throughout the 
system may or may not be safety-wired. The aircraft maintenance manual will indicate any safety wiring requirements. 


13.2.42 Hydraulic hoses seem to be better protected or receive better inspection action than tubing, but line 
chaffing is still prevalent. Hoses, when routed close to engine compartment fixtures or structures, are usually covered 
with an anti-chafe covering or combination fire ablative material. High-pressure hoses constructed of high-strength wire 
braided tubing have a frequent failure mode related to chafing. After a fracture, the failure is obvious, but to detect a 
typical chafe condition and plait wear, the investigator must use a 10-power magnifier. 


13.2.43 Hose failures generally are the result of chafing or failure at the connector ends, and occasionally are due 
to the poor quality of locally manufactured replacements. Installation errors, such as failing to control the hose condition 
when tightening the connection, cause the hose to twist into an abnormal position. This failure is more likely to occur 
when the hose is connected to a unit that has attachment movement. 


13.2.44 Of particular interest to the investigator when confronted with failed flexible hoses is the industry's use of 
preformed hoses. The hoses used on engines and in limited space areas of aircraft compartments are sometimes 
manufactured with a particularly defined curvature. Unfortunately the amount of contour is not always readily noticed, 


IIl-13-10 Manual of Aircraft Accident and Incident Investigation 





and the hose can be installed in reverse or in opposition to the desired contours. This places the hose in a strained 
position, probably causes clearance problems, and affects its service life. A preformed hose is usually placarded as such, 
and mentioned in the maintenance instructions. Preformed hoses have been delivered with restraining wire and tape to 
force them into boxes which are not properly shaped for the particular hose. 


13.2.45 The length of a hose is frequently critical and hoses that are too short may stretch and fail whereas hoses 
that are too long can bind in the associated mechanical components or develop a kink, fracturing the inner liner. 


13.2.46 Hydraulic quick disconnects have been a factor in incidents and mishaps. By virtue of their purpose, they 
are usually located in positions where it is difficult to connect them or to observe their locked condition. Some designs 
contained a self-locking feature, but were later found to be in need of safety wiring. Whether the design incorporated a 
blocking fluid check feature or not, an accidental separation usually compromises safety of flight. Determining the status 
of a quick disconnect after a mishap is usually fruitful. If the quick disconnect was connected, the lines show signs of 
stretch or failure or the disconnect displays signs of a forcible separation. 


13.2.47 The most frequent cause of hydraulic failure due to fluid loss is related to the assembly of hydraulic fittings 
using the jam nut and “O” ring seal. There is an optimum position for the seal to perform its function. If the fitting is 
threaded in too deeply then, when the jam nut is tightened, the “O” ring is forced into the upper thread section. If not 
threaded to the correct depth, the “O” ring will be in contact with the lower thread area. Either position cuts or damages 
the “O” ring seal. The correct final “resting place” of the “O” ring seal after the jam nut is secured should be in the middle 
of the non-threaded section, or at least not in contact with the thread. Assuming the correct seal size and material are 
selected, the second concern is a fitting and positioning problem. 


13.2.48 During an investigation it is not uncommon to find fitting tube “B” nuts loose, raising suspicion that the “B” 
nuts were not properly torqued. During a break-up, if a tube is subjected to a sizable tension load, the tube stretches at 
the flare and relieves the nut tension displayed as a finger loose nut or a backed off condition. This condition is usually 
accepted as “normal” when a large number of loose nuts are discovered. 


Air contamination 


13.2.49 It is usually difficult or impossible to confirm entrapped air in the hydraulic system after an aircraft mishap 
has occurred. The entrapped air evidence and hydraulic fluid is usually lost if the mishap results in significant aircraft 
damage. Air in the hydraulic system should be suspect when the records reveal that the accumulator or reservoir 
required frequent reservicing with nitrogen before the mishap. This is probably the most difficult area to isolate when 
evaluating the hydraulic system during an investigation. The entrapment of air in a closed hydraulic system can produce 
a series of problems, starting with erratic pump control and cavitation in the pump, which has the capability of causing 
mechanical damage to the pump mechanism. A pilot's report of fluctuating hydraulic system pressure, erratic control 
response, or unusual high frequency vibration or noise when the hydraulic system is exercised can be an indication of 
air in the system. 


Hydraulic and pneumatic components: functional testing 


13.2.50 Prior to beginning tests of hydraulic components, obtain samples of fluid to be analysed for contamination, 
acid and water content and type of fluid. Once a component is mounted in a test fixture and pressure hoses are attached, 
the unit will be exercised to purge the passages of air. The first fluid which issues from the return ports should be caught 
in a suitable container and examined for foreign material which may be present in the unit. A piece of seal material or 
other debris may have lodged in valves or passages and could be dislodged during purging. Ascertain the working 
pressure of the component and ensure that the test equipment can supply adequate pressure and rate of fluid flow. 
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13.2.51 Hydraulic fluid from each hydraulic system should be analyzed using mass spectography to determine 
what contaminants may be present including additives and mixes of hydraulic fluids. The results should be compared to 
the acceptable servicing requirements according to the manufacturer’s and operator's specifications and maintenance 
manual. 


13.2.52 Testing of hydraulic and pneumatic components should cover operation of check valves, relief valves, 
shut-off valves and leakage rates. Actuator piston rods should be checked for breakaway forces required for initial 
movement from the static position. Look for evidence of excessive internal leakage or bypass. Disassembly and internal 
examination should be accomplished if conditions warrant. Look especially at the condition of seals and valves, 
evidence of overheating, cavitations and excessively worn parts. The manufacturer’s functional test procedure will be 
very detailed and will include all necessary tolerances. These procedures should be followed carefully. 


13.3 ELECTRICAL SYSTEMS 


13.3.1 The external evidence, crew statements, on-board recordings, witness reports, air traffic control 
communications recording, etc., will generally provide the initial direction for the electrical system investigation. This 
information can be used in conjunction with the aircraft maintenance manuals to identify key system components, wiring 
segments, etc., for detailed evaluations. These items should then receive priority consideration during the recovery 
operations. 


13.3.2 The electrical system consists of a power-production device or devices and their control systems, 
mechanical or fluid couplings, inverters or transformer-rectifiers, emergency power equipment, electrical wiring, circuit 
breakers or fuses, connectors and busses. 


Generators, alternators and inverters 
General 


13.3.3 The electrical power production devices on most modern aircraft are alternators which provide 200/115 
volts alternating current (VAC) electrical power at 400 hertz (cycles per second). These devices are generally engine 
driven, and the total number on each engine or aircraft varies greatly based on the total electrical power needed and the 
individual device's generating capacity. The greater the power requirement, the greater the number of alternators. The 
technical manuals for the given aircraft should be consulted for specific details. 


13.3.4 Some aircraft and especially general aviation aircraft have 12 or 28 volt direct current (VDC) generators. 
These are almost without exception attached directly to the engine with a mechanical coupling. 


13.3.5 The output of the alternators or generators is regulated by device control units. The control devices protect 
the electrical system or device when malfunctions occur. Typically, the protective functions deal with overvoltages, 
undervoltages, frequency variations on AC generators (alternators), excessive differential between phases on AC 
generators, bus faults, and reverse currents. The control devices are fail-safe in that an internal device failure causes the 
respective AC or DC generator to drop off the line. 


Mechanical or fluid couplings 
13.3.6 The most common method of attaching the alternators to the engines is by a constant-speed drive (CSD) 


unit. These are fluid couplers which act much like the transmission on an automobile and consist of a hydraulic pump, 
hydraulic motor, and speed-control regulation mechanisms. 
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13.3.7 The couplers drive the alternator at a near constant speed, even though the engine is operating from idle 
to full power. The CSDs have their own oil supply and an oil-to-air heat exchanger to cool the coupling oil. The CSDs 
use engine oil, but the systems are completely independent of the engine oil system. Many of the couplers can be 
disconnected in flight remotely in the event of a malfunction, but usually cannot be reconnected in flight once they have 
been disconnected. Also, some CSDs provide for automatic disconnect in an extreme overheat condition. 


13.3.8 The alternator's principle of operations requires a constant speed to provide regulated power, so they are 
never connected directly to the engines using mechanical couplings. The reverse is true for generators, and they are 
almost always connected directly to the engines using mechanical couplings. The mechanical coupler shaft for 
generators usually contains a shear or weak point which is designed to serve as a controlled failure point in case of 
generator mechanical failure or seizure. This in turn disconnects the generator from the engine mechanically. The shear 
point concept mechanically disconnects the generator in case of a major mechanical failure and does not disconnect the 
generator when an internal electrical malfunction occurs. The remote disconnect feature on many of the CSDs for 
alternators has proven to be more satisfactory than the shear couplings on the older DC generator systems. 


Power conversion devices 


13.3.9 Aircraft may require both 28 VDC and 200/115 VAC 400 Hz electrical power. So, regardless of whether the 
aircraft has 200/115 VAC alternators or 28 VDC generators, power conversion devices are required to convert DC to AC 
electrical power or vice versa. 


13.3.10 The 28 VDC transformer-rectifiers are provided on alternator-equipped aircraft to provide a reliable source 
of DC electrical power. Direct current power is needed for many of the control and lighting circuits and to recharge the 
aircraft batteries. 


13.3.11 The 115 VAC, 400 Hz, inverters are installed on generator-equipped aircraft to provide needed AC 
electrical power. An inverter is a DC electrical motor connected to an AC generator. Alternating current power is needed 
for most communications, navigation, and radar systems. 


13.3.12 Additionally, modern computer systems require a wide variation in input voltages and current types. Some 
systems utilize micro-volts and milliamps. Electrical requirements may be critical to the operation of systems and 
investigators should determine the system requirements and the power production sequence that is designed to provide 
it. 


Malfunction analysis 


13.3.13 Investigators should examine the above listed components for evidence of arcing, burning, faulty brushes, 
improper wire or cable connections and overheat. Visual examination of generators may detect signs of excessive 
output. When a generator operates under excessive load for more than a relatively short period, the increase in heat will 
cause discoloration of the commutator bars or melting of solder. In severe cases, the commutator bars may rise to a 
point where the bars interfere with the brushes and the brushes are broken off and carried away. If such a condition is 
found, it is apparent that the output of the generator was passing through a path of lower resistance than intended and 
strongly suggests the presence of a short circuit somewhere in the electric power system. 


13.3.14 Bearings should be examined for lubrication, wear, looseness and roughness. Worn or loose bearings can 
cause the armature or rotor to contact the field or stator windings and cause other internal damage. Rotational damage 
(peripheral scratches, scrolling) on rotors and/or stators of electrical motors, dynamotors, inverters, and gyros indicate 
that the component was rotating at the time of impact and, therefore, some electrical power (AC or DC) was available. 
This is not infallible, as gyros may coast for a considerable time and thus introduce the possibility that power to the gyro 
was interrupted some time before impact. Components most likely to contain rotational damage evidence are fuel 
booster pump impellers, impeller housings, cooling fans attached to armatures and associated housings. Scoring 
evidence on these elements is found in many instances when the armature and field assemblies are relatively intact and 
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free of any physical contact between rotor and stator assemblies. Rotational damage found in engine-driven generators 
or alternators can support other evidence that electrical power was available. This evidence by itself shows only that the 
machine was rotating, and not necessarily proof that electrical power was being furnished. The CSD should be tested 
along with the AC alternator when conditions permit. 


13.3.15 Examine the rotors and bearings. Generators, alternators and larger motors are sometimes so severely 
damaged that the stator has impacted around the rotor preventing easy separation. Separating the rotor by forcing it out 
with a power press may be permissible, since evidence of scoring will not be destroyed by forced separation. In severe 
cases the stator assembly may have to be sawed longitudinally to separate the two components. 


13.3.16 The bearings of rotating electrical components should be examined to determine if the component 
sustained rotational damage during the impact. When damage occurs before impact, it is necessary to determine the 
effect on the immediate system, other systems, and the aircraft operations. 


13.3.17 The commutators should be examined for signs of arcing, roughness, and copper bridging. Copper 
bridging causes shorting between segments, and unwanted paralleling of the armature windings. 


Drive shaft failures 


13.3.18 Engine-driven DC generator drive shafts (quill shafts) fail occasionally. It is important to recognize the 
various types of fractures that occur. 


13.3.19 A shaft fractured at the shear point (necked down portion near the drive end) and which has the 
appearance of having been machined off in a lathe, probably failed at the designed shear section from sudden generator 
stoppage, abnormal rotational stresses induced by generator overload, or by excessive mechanical friction due to 
bearing failure and resultant rotor-to-rotor friction. 


13.3.20 Fires have been ignited by generators because the shaft did not shear at the designed shear section, and 
permitted rotation of the armature up to and beyond the time of generator destruction. The abnormal heat generated by 
the rotor rubbing the stator has ignited fuel, hydraulic, and oil lines near the generator. There are also cases where the 
shaft sheared at other than the designed shear section because of induced overheat or extreme misalignment due to 
generator bearing failure. It is normal for a generator shaft to shear when sudden engine stoppage is involved. There are 
also shaft failures caused by bending when the generator or CSD is subjected to side loads during ground impact. 
Where causes of shaft fractures cannot be readily determined, assistance should be requested from metallurgical or 
structural specialists. 


Constant speed drive unit failures 


13.3.21 The CSDs may include a shear shaft similar to that found in DC generators. Shaft failure may result from 
AC generator internal failure or AC generator binding during the impact. The CSD oil should be checked for quantity and 
condition. Severe overheat may result in oil discolouration and breakdown. The CSD may contain an oil filter pressure 
differential indicator to show filter contamination or blockage. CSDs frequently contain thermal devices to automatically 
disconnect the alternator when the oil overheats for any reason. These should be checked. Undamaged CSDs may still 
rotate. If so, it may be possible to completely check the CSD on a suitable test stand. If the shaft does not rotate, a 
formal tear down report (TDR) may be needed. CSD malfunctions can cause the AC generator to rotate at less than the 
prescribed revolutions per minute (r/min). This in turn causes incorrect alternator frequency output. The frequency must 
be maintained for the alternators to be paralleled and for the various frequency-sensitive components to operate 


properly. 
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Batteries 


13.3.22 Batteries will generally be badly damaged during severe impacts due to their location and mountings. 
Undamaged batteries provide the best source of information, but some data can be determined from damaged batteries. 
The condition of the batteries may be very significant since they provide emergency power for critical equipment under 
emergency conditions. 


13.3.23 A hydrometer can be used to check the specific gravity of the electrolyte in lead-acid batteries. A specific 
gravity showing a high state of charge with a maximum voltage available indicates the systems were operating normally. 
A battery with a low charge state suggests that a situation requiring the use of emergency power may have existed 
before impact or that the battery was old and not fully serviceable. Care should be exercised in opening batteries to 
check for physical evidence such as partial or extensive disintegration of the positive plates, buckling or warping of all 
plates, or large amounts of sediment (particles of lead sulphate) in the bottom of the case. These indicate poor battery 
conditions. 


13.3.24 The assistance of a battery specialist is required to test the charge of alkaline (nickel-cadmium, silver-cell, 
etc.) batteries. The state of charge for these types of batteries cannot be determined by checking the voltage and/or 
electrolyte specific gravity. The individual cells do not charge evenly because each cell takes a slightly different load 
when charging. A significant imbalance between cell charges may suggest a dead battery even though a full charge of 
12 or 24 volts is indicated. This results because the weakest cell discharges first. A dead cell will prevent proper battery 
performance during an emergency situation. 


13.3.25 A battery compartment explosion may occur with both lead-acid and alkaline batteries. The explosion can 
be the result of charging gases or thermal runaway. Charging gas explosion gives the appearance of an external 
explosion, whereas thermal runaway problems appear as an internal overheat condition and explosion. A specialist 
should be consulted when thermal runaway is suspected. 


Transformer rectifier units 


13.3.26 These units convert alternating current to direct current electric power and are utilized where the basic 
electric power system is supplied by alternators. These units are solid state and their condition and ability to function can 
only be ascertained by testing. 


Voltage and frequency regulators and inverter control 


13.3.27 Units like voltage regulators, frequency regulators and reverse current cut out relays and solid state 
generator control or protection panels should be tested to determine their prior control settings and ability to function as 
designed. Relay contacts and coils may be examined for evidence of malfunction and internal circuitry should be tested 
for integrity. The units should be examined in detail when malfunctions or discrepancies are noted. 


Distribution centers 


13.3.28 All bus bars, terminal strips and junction boxes should be examined for signs of damage to cable and 
wiring connections. The investigator should also look for evidence of loose studs, arcing between adjacent terminals, 
overheat and burning. Improper connections can result in sufficient heat to melt bus bars and the terminal strips around 
stud bases: this could lead to loss of portions of the electrical system or even complete loss of electric power. These 
conditions have also led to electrical fires in flight and on the ground. The possibility that foreign objects may have fallen 
across terminals, resulting in direct shorts and fires, should also be examined. 
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Circuit protectors 


13.3.29 This includes fuses, circuit breakers and current limiters. These devices are installed to protect wiring only. 
Electrically operated components will usually have integral protection if deemed necessary by the manufacturer. All 
circuit protectors should be examined for tripping or melting of the fusible strips. Circuit breakers may trip if subjected to 
externally applied heat such as in a post-crash fire and may also trip when subjected to heavy physical shock. This could 
provide an erroneous indication of a circuit malfunction to the unwary investigator; therefore, that circuit should be 
examined further before making a diagnosis. Fuses and current limiters may remain intact even though a circuit 
malfunction occurs if the electrical fault is removed rapidly. For instance, a power lead may short to ground on the 
aircraft structure and burn through rapidly before the protector has an opportunity to react. Circuit breakers are prone to 
deterioration with time and their ratings may change. Some breakers have been found with internal corrosion and would 
not trip at all. Such conditions could turn an electrical fault into a serious problem. 


Relays and solenoids 


13.3.30 Relay contacts should be examined for burning and pitting. They may even be found welded together. 
Check also for weak or broken relay springs and open, shorted or burned coils. Solenoids should be examined for 
overheating or failed coils. These findings may lead to detection of related circuit malfunctions. 


Electric motors 


13.3.31 Electric motors should be examined for evidence of electrical distress and evidence of operation at impact. 
Examine wiring, brushes, commutators or slip rings, and field armature windings: look for evidence of overheating, 
burning, arcing, faulty connections and open or shorted windings. Examine the component being driven by the motor to 
determine its condition, looking especially for a malfunction which could be detrimental to motor operation. Check the 
drive coupling or connection for being sheared or intact. The motors may drive fans or other rotatable components which 
could yield operational evidence through scoring or bending of fan blades, or scraping of a rotating component when it 
separated from its housing. There may be impressions on rotating components which would indicate that the unit was at 
rest or otherwise not operating when physical damage occurred. Motor bearings should be examined for wear or 
looseness which would allow the armature to contact or rub against the field winding post pieces. The commutator and 
brushes should be examined for copper bridging, broken brushes or loose brush wiring. 


Electric wiring 


13.3.32 Field examination must be limited to what the investigator can see or measure with little analytical 
assistance. A magnifying glass and multimeter will be the best tools for this work. The purpose of this examination is to 
identify any wiring that should be removed for laboratory analysis. There are three basic reasons why wiring would be 
important to the investigation: it was the ignition source for a fire, it contributed to the failure of significant onboard 
systems or it provides information about possible mishap scenarios. 


13.3.33 Damage to wire is often caused by one of three failure mechanisms: electrical, mechanical or fire. Wire 
should be examined for both failure characteristics and failure condition. Failure characteristics are the physical features 
which the investigator may examine or test. This physical evidence may be used to infer the conditions present before, 
during, or after an event. Each failure characteristic will have associated with it one or more sets of possible failure 
conditions. Failure conditions are the mechanisms that caused the damage. The investigator will use the evidence to try 
to determine which failure conditions were actually present during the accident. 
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Wire types 


13.3.34 The largest class of aircraft wire is commonly referred to as “hook-up” wire. This wiring is primarily copper 
and is used as interconnect cable between pieces of equipment, harnesses attached to the airframe, and for 
interconnect wiring inside of equipment. Other types of wiring that may be found, and should be examined, include multi- 
conductor cabling, high voltage cables, special purpose data cables, and shielded coaxial or multi-axial cables. 


13.3.35 Two copper alloys are employed in aircraft wiring: 


a) oxygen free high conductivity, or OFHC, copper is 99.99% pure copper and has an annealing 
temperature of 370 — 650°C; and 


b) high strength copper alloy, or HSCA, is usually a cadmium-copper or cadmium-chromium-copper 
alloy. This alloy has improved mechanical properties including increased tensile strength and 
resistance to annealing at elevated temperatures. HSCA has an annealing temperature of 535 — 
760°C. 


13.3.36 Copper wire used in aircraft is coated to provide environmental protection and to promote better 
connections. The coatings are applied to the individual strands of the conductor, usually by electroplating. 


13.3.37 Conductors are provided with insulated coverings which provide environmental and mechanical protection, 
as well as electrical insulation. Almost all aircraft wire uses polymeric insulation materials. Glass braid, glass tape and 
other materials are used to a lesser extent. In addition, it is common to also encase bundled wire in jackets of wound or 
extruded material to further protect the wiring from mechanical damage. 


13.3.38 Electrical arcing frequently occurs when two conductors of opposite polarity come into close proximity. 
Arcing from conductors to the aluminium airframe is also common since the airframe is generally at the ground potential 
of the electrical system. Intermittent contact occurs from chaffing and insulation breakdown. The heating is a result of the 
arc current and the voltage drop that occurs where arc is established. The voltage-current product associated with the 
arc represents the thermal power available to cause conductor melting. For example, a 20A short-circuit on a 28V 
system will result in 560 watts of thermal power. Most of this power will be dissipated in a relatively small area near the 
arc. Arc welding experience suggests that voltage at the arc will be between 10 and 35V for currents up to several 
hundred amperes. Arcing will be associated with non-uniform melting and loss of conductor material. 


Failure characteristics 


13.3.39 Specific failure characteristics may be observed which will help identify the failure condition of a particular 
wire. The failure characteristics should be distinguished from the failure condition since there is not a one-to-one 
relationship between the conditions and the resulting characteristics. For example, recrystallization can result from 
electrical overcurrent conditions or fire exposure. 


13.3.40 Several of the damage characteristics can appear in non-uniform areas. For example, less than one inch of 
wire may be damaged. In other cases the damage is uniform over a larger area sometimes up to several feet in length. 
Whether or not the damage is uniform can help verify the failure mechanism at work. 


a) Recrystallization is caused by electrical overheating or fire damage. The process of cold drawing 
copper wire results in a reduction in grain size and an elongation of the crystal grain structure along 
the axis of the wire. If the wire is subsequently heated to the recrystallization temperature, the grain 
structure undergoes a transformation. 
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b) 


c) 


qd) 


Beaded wire ends are an indicator of electrical arcing. Extreme non-uniform heating results when 
wiring is involved in electrical arcing. The heating causes the copper to melt and form spherical 
globules, or beads, on the ends of the wire strands. Beaded wire ends are a non-uniform 
characteristic. It should be understood that beaded wire ends sometime result from fire damage. 
(See Figure III-13-2.) 


Metal transfer is an indicator of electrical arcing. Metal transfer occurs when an arc forms between two 
conductors with sufficiently high energy that one of the metal surfaces is heated to vaporization. In 
some cases metal is transferred in droplets which are visible on adjacent surfaces. Testing for metal 
transfer should be done on a comparative basis using samples of the undamaged materials as a 
baseline. 


A cup-and-cone fracture is an indication of mechanical failure. A cup-and-cone fracture can occur 
when ductile wiring material undergoes tensile loading that exceeds its tensile strength. High tensile 
stress on wire occurs frequently during accidents. Initially under high tensile stress the wire will 
elongate. The elongation is accompanied by a reduction in cross-sectional area called necking. Once 
necking occurs, voids form in the center and are edged by radially forming cracks. The spreading 
cracks form a shear lip near the surface at a 45° angle. The characteristic cup consists of a flat center 
region with dimples and an outer 45° shear lip; the opposite fracture surface forms the cone. 


Insulation failure is an electrical failure condition, but may be initiated by mechanical abrasion or 
chaffing. Insulation failure is the catastrophic electrical breakdown of the insulation material. It is 
usually attributed to poor arc-tracking resistance and is caused by carbonization of the insulating 
material. The carbonized insulation is conductive and provides a current path between the conductor 
and other live electrical components. Insulation failure may occur over time, or may happen very 
suddenly as when initiated by mechanical abrasion of the insulation material. In any case, insulation 
failure is generally an initiating event and is accompanied by arcing. 








Thermally Damaged Insulation 
Normal Insulation 
(No Thermal Damage) 
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I 
[a eee 
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Copper 
Removed 


Figure Ill-13-2. Beaded wire end from arcing 
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ili) 


vi) 


vii) 


viii) 


In the early stages of insulation breakdown, low current discharges occur between the conductor 
and other energized components. These may occur at pinhole flaws in the insulation or at sites 
where chemical contamination has compromised the insulation. 


At bends in the wire, radial cracks may develop from manufacturing defects of chafe damage and 
propagate completely through the insulation material to the conductor. The bare conductor is 
thereby exposed rather quickly, catastrophically accelerating the breakdown. Environmental 
factors can greatly accelerate insulation mechanical property degradation. Examples are sunlight 
(ultra-violet radiation), moisture, and various aircraft fluids. The problem is especially severe in 
moist environments. 


Thermal damage to insulation is caused by exposure to any heat source and is not specific to one 
failure condition. Polymeric materials undergo chemical breakdown at elevated temperatures. 
Although each material is different, some common changes in properties are: gradual 
discolouration, usually darkening, loss of flexibility and cracking and loss of electrical resistance 
properties. Severe thermal damage causes some insulation to crumble or “flake off’ the 
conductor. The investigator should exercise additional care to preserve suspect insulation 
material for laboratory analysis. 


Damage on inside surface of insulation. When the insulation is peeled away from the conductor, 
the inside surface appears discoloured while the outside surface does not. This suggests that the 
conductor itself was the heat source as in the case of electrical overcurrent. 


Damage on outside surface of insulation. The insulation is damaged on the outside surface only. 
This suggests that an external heat source was involved. 


Insulation resistance changes. Typical insulation resistances exceed 100 mega ohms when 
measured between the outside surface of the insulation and the conductor under ideal conditions. 
After significant thermal damage, resistances below 1 mega ohms can be measured. This may be 
used to verify the damage. Kapton is an example of a material that exhibits this behaviour. 


Glazing. Some materials become shiny or glazed when exposed to a radiant heat source. 
Polymide is an example of insulation which may exhibit this evidence. 


The maximum temperature that wire or insulation was exposed to is valuable information for an 
accident investigation. Unfortunately, thermal damage depends on temperature and exposure 
time so that a maximum temperature is difficult to judge from a visual examination of the 
insulation alone. Nonetheless, it is customary to get some indication of temperatures that might 
have been attained by noting the damage relative to the known properties of the insulation 
material. 


Melting of polymetric insulation is a common indicator. Insulation made of thermo-plastic polymers 
will exhibit melting before significant chemical breakdown occurs. The melting temperatures for 
some materials of this type are listed below and provide a rough guide during examination: 


Polyethylene 100-150°C 
Polyvinyl Chloride (PVC) 221°C 
Nylon 200-250°C 


Polytetrafluoroethylene (PTFE) 327°C 
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x) Thermosetting polymers will not melt at elevated temperatures. The first signs of damage may be 
cracking or discolouration. Typical maximum service temperatures for some thermosetting 
materials are listed below: 


Silicones 260°C 
Polymides 60-315°C 


xi) Carbonization of aromatic polymide insulation occurs in the range of 650°C. 


f) | Conductor discolouration. Discolouration of the conductor is caused by thermal exposure and is the 
result of oxidation and absorption of coating materials into the copper. Characteristic colour changes 
have been noted on wires at slightly elevated temperatures, even before significant thermal damage 
occurs. Although the colour changes themselves are not important, they can provide some useful 
clues to the investigator during initial visual examinations. 


A variety of chemical compounds are present in post-impact fire which can cause conductor 
discolouration. The examples below should be used as general points of reference only. 


i) Silver-coated wire. Between 200-250°C, the silver and copper diffuse into each other. The wire 
loses its shiny appearance and takes on a dull brown colour. 


ii) Tin-coated wire. A similar mechanism occurs at lower temperatures in the range of 150-170°C. 


iii) Brown, red and black copper oxides form on the surface of the conductor after the plating has 
disappeared. The colour may depend on the thickness of the oxide layer. 


iv) Green copper-based compounds form when the base metal is exposed to moisture, water, and 
other liquids. This sometimes occurs when the copper is exposed to the elements as a result of 
extreme thermal damage or arcing. 


v) Silver-coated wires frequently take on a dull yellow colour at relatively low temperatures. This may 
be caused by the formation of sulfides or other compounds of silver. Fuel, hydraulic fluid and fire- 
fighting foam can cause a variety of compounds like this. Specific analysis may be required. 


Field examination 


13.3.41 It is important to record precisely where the wiring was situated before removing it from the aircraft. Hand 
sketches of the area and photographic records are recommended. When a wire is cut for removal, both sides of each cut 
should be tagged and labeled with a unique identification number. The number should be referenced in sketches and 
included in photographs where possible. The investigator should attempt to remove the largest section of wire practical. 
This provides the laboratory analysts with useful areas of undamaged wire for comparison purposes. If possible, bundles 
or individual conductors should be removed in their entirety end-to-end. 


13.3.42 If wiring failures are suspected at the point of connection to a piece of equipment, the equipment should be 
removed with the wire. Care should be exercised in removing the equipment especially when the interconnection itself is 
in question. The effective resistance of corroded, loose, or partially welded connections can be altered dramatically by 
small movements. 


13.3.43 When arcing is suspected, other nearby segments of wire or airframe material should be removed in 
addition to the wiring in question. This will allow the material in the opposing surfaces to be analyzed by Energy 
Dispersive Spectrometer (EDS) to verify materials transferred during the arcing. Samples for arc material analysis 
should always be included with undamaged areas for comparative analysis. 
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Determining the failure condition 


13.3.44 Wire damage is a complex process. It is generally not possible to associate one failure characteristic to 
one failure condition. For example, recrystallization is associated with thermal damage and overcurrent. The failure 
characteristics present in the accident must be identified first. Table III-13-1 provides a checklist of those characteristics 
that can be used during the examination process. 


Table Ill-13-1. Failure characteristic checklist 





CHARACTERISTIC YES NO COMMENT 
RECRYSTALLIZATION 
Uniform 











Non-uniform 





Beaded wire ends 





Single conductor 





Multiple conductors 
METAL TRANSFER 
Conductor deposits — EDS 











Structure deposits — EDS 
CUP-AND-CONE FRACTURE SURFACES 
Single strands/wire 











Multiple strands/wire 
INSULATION FAILURE 
Carbonized insulation present 











Polymide insulation 

Chafing 

THERMAL DAMAGE 
External heat source present 














Discolouration — Outside of insulation 





Discolouration — Inside of insulation 





Condition 





Temperature rating for decomposition or melting 





Decomposition apparent 





Electrical resistance change 
CONDUCTOR DISCOLOURATION 
External heat source 











Conductor heat source 





Wire coating 





Approximate temperature for discolouration 





Uniform 





Non-uniform 
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13.3.45 Once the failure characteristics have been identified, the failure condition can be assessed by using 
Table Ill-13-2 below. 


Table Ill-13-2. Failure condition checklist 





CONDITION YES NO 
ELECTRICAL OVERCURRENT 
Recrystallization 











Discolouration of conductor 





Uniform damage 
ELECTRICAL ARCING 
Beaded wire ends 











Material transfer 





Non-uniform damage 
INSULATION FAILURE 
Chafing 

Carbonized insulation 














Non-uniform damage 
MECHANICAL FAILURE 
Cup/Cone fracture surface 











Elongation of wire end 
EXTERNAL THERMAL DAMAGE 
Insulation damaged on outside vs. inside 











Recrystallization 





Non-uniform damage 





Insulation resistance changes 

















Electrical components: functional testing 


13.3.46 The more simple tests may consist of running generators, alternators and inverters on a test bench to 
determine their ability to provide suitable electric power under conditions of no-load and full load. The mated voltage and 
frequency regulators or control panels should be used during these tests if their condition permits. 


13.3.47 Electric motors should be examined for shorted or open field and armature windings, bad brushes and 
commutators or evidence of malfunction which would cause them to draw excessive current. Be sure to use electrical 
power of the proper voltage and phase when testing these components. Relays and regulators, as well as black box 
electrical system control components, will require more detailed testing. Relays will generally have specific operating 
settings and these should be determined from manuals on the system involved or from information supplied by the 
manufacturer. The relay type and model number must be ascertained when seeking these specifications. 


13.3.48 Voltage and frequency regulators of the carbon pile type should have the carbon stack condition examined 
after they are tested to determine their regulatory capabilities. Stack deterioration will cause the regulators to malfunction. 
Generator and alternator protection and control panels are mainly electronic in nature and will require special testing 
equipment. Ensure detailed circuit diagrams and specifications are obtained for the testing and troubleshooting of these 
components. Failures in relays and regulating components have resulted in many cases where essential electrical service 
was lost due to overheating of equipment, overvoltage and excess current draw and even destructive electrical fires. 
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Light bulbs 
Introduction 


13.3.49 Light bulb analysis has been used for many years to help investigators determine whether power was or 
was not available to the various aircraft systems. Current research is showing that the age of the bulb plays a significant 
role in the analysis. Bulbs subjected to the same g-forces for the same number of milliseconds will vary significantly, 
based on the age of the bulb. The following information will provide an overview into light bulb analysis techniques. 


Note.— Field investigation of light bulbs should be limited to “classic hot” or “classic cold” indications due 
to the unknown age of most light bulbs. 


13.3.50 Aircraft crash-impacted light bulb analysis can be a very important technique for interpreting the physical 
evidence related to the state of the aircraft electrical power at the time of impact. The basic techniques and concepts are 
relatively simple. The damage to the light bulb's filament during the impact is different based on whether the bulb was on 
or off at the time of the impact. 


13.3.51 While the techniques and concept are relatively simple, reliable interpretation of the filament damage can 
be very complex. This is because of the dynamics of the impact, different types of light bulbs, age of the bulbs, and 
varying orientations of the light bulbs relative to the impact force axis or axes. Accordingly, the results should be 
carefully compared to other evidence, and a specialist should be used if the light bulb analysis is in conflict with other 
evidence or if the findings are of critical importance to the mishap investigation findings and recommendations. 


Terminology 
13.3.52 See Figure III-13-3 for an illustration of the components described below. 


a) Glass envelope. The filament structure is surrounded by a glass envelope. The envelope is either 
evacuated or filled with an inert gas to prevent oxidation of the filament. 


b) Tungsten filament. Incandescent lamp filaments are made of nearly pure tungsten. The voltage and 
power requirements dictate the dimensions of this wire which is usually so long that it must be coiled 
or double coiled to fit in the envelope. 


c) Contact posts. Contact posts provide the electrical attachment points for the ends of the filament. The 
posts must protrude through the envelope for external electrical connections. The posts are made of a 
special material called Dumet, a nickel-iron alloy with an outer coating of copper. The alloy has a 
coefficient of thermal expansion that closely matches that of glass; the copper coating provides a 
reliable seal to the envelope. 


d) Support posts. Although the contact posts are the primary means of mechanical support for the 
filament, many designs require additional supporting members. For example, the type 327 lamp has 
two support posts. Support posts are usually made of molybdenum, because of its high melting point: 
2 410°C. 


e) Mounting bead. A glass mounting bead secures the contact posts to the lamp base. The bead is of a 
non-conductive material to electrically separate the contact posts and the base. 
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f) Base. Most lamps are equipped with a metal base to provide mechanical support for the glass 
envelope and its contents, as well as one of the electrical contacts. There are three types of bases: 


Flange base lamps have a circumferential flange near the bottom of the base which helps hold 
the lamp in its socket. 


Bayonet base lamps have two small posts on the base which mate with slots in the socket. This 
type of attachment requires a twisting motion to latch the lamp in place. 


Baseless lamps have wire leads which are soldered directly to printed circuit boards or terminal 
strips. 


g) Electrical contacts. Each style of lamp must have at least two electrical contacts. On baseless lamps 
the leads provide the two connections. On flange and bayonet lamps the body of the metal base is 
one contact. A metal button mounted on an insulator at the bottom of the base is the other contact. 


Variables 


13.3.53 The type and nature of the impact loading can significantly affect the way the filament fails. The wreckage 
should be carefully examined to determine the nature, especially magnitude and duration, of the impact to permit reliable 
assessments of aircraft light bulbs. 
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Figure Ill-13-3. Components of a small flange base incandescent lamp 
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13.3.54 The basic aircraft light bulb has a coiled tungsten filament suspended between two posts. The coiling of 
the wire effectively shortens the filament length, allowing the bulb to be more compact. The most common type bulb has 
a coiled filament in the shape of an inverted U with the ends attached to the terminal posts and the upper section held by 
two support posts. There are many other types, but all have similar failure characteristics with some having more 
pronounced failure modes. 


13.3.55 A variety of voltages are found in the typical aircraft lighting systems, but all perform essentially the same 
function. The current from the applied voltage develops an operating temperature in the filament of about 1 600 °C. The 
temperature is lower near the terminal and support post because these act as heat sinks. The heated filament is easily 
hot-deformed when subject to extreme external forces. As the voltage drops from the designed operating voltage so 
does the temperature of the filament. The applied voltage and resulting current determines the filament temperature and 
consequently the amount of ductility of the filament at the time of impact. This fact is the basic principle of light bulb 
analyses techniques. 


13.3.56 The aging of the light bulb also effects the failure mode. High temperatures and current over time cause in 
all fine wire filaments a phenomenon known as “notching.” Notches are sawtooth irregularities on all or part of the 
filament surface after the bulb has been in service for awhile. The notching is more severe for DC-powered bulbs than it 
is for those powered by AC. The age (amount of notching) affects the filaments failure characteristics. Cold filaments 
with severe notching have shattered completely under severe impacts. Aging also may distort the filament by forming 
loops and curves in the filament, but this usually does not affect the tight coil of the filament. So loops and curves due to 
aging can usually be identified as compared to those caused by lighted bulb impact failures. 


13.3.57 The bulb orientation can be important depending on whether the forces are down the axis or transverse to 
the bulb axis. On the other hand, because in most high-g force mishaps there are multiple impacts, the bulb failure is 
caused by multiple and varying loads as opposed to a single fixed orientation force. 


The evaluation 


13.3.58 The investigator should collect and label as many light bulbs as possible to provide for comparisons as part 
of the light bulb analysis. The identification of bulbs which should have been on or off at the time of impact will assist in 
evaluating the specific bulbs in question. It is very important to properly document the location of the bulb to be 
evaluated. 


13.3.59 The filaments should be evaluated using an 8 to 10 power magnifying glass as a minimum. Laboratories 
have more powerful devices which may provide additional information in critical cases. 


13.3.60 Electrical light bulb filaments are typically tightly wound coils evenly spaced between the base and the 
filament support hangers. When the coil is heated and is exposed to sufficient shock, the symmetrical coils become 
distorted and show random stretch and dislocation. The amount of stretch or distortion depends on the magnitude and 
direction of the shock or g-loading. A hot filament usually does not break; however, lighted status should not be 
summarily dismissed just because a filament is broken. 


a) Filaments which have clean and bright breaks without globe discolouration indicate impact failure of 
an unlighted bulb. 


b) Filaments which have melted globules or nodes on the broken ends with a discoloured globe indicate 
a burned out bulb, probably before impact. 


c) Filaments which are severely stretched (uncoiled) indicate a lighted bulb at the time of impact. 


d) Filaments of broken envelopes (globes) may be stretched by contact with foreign objects. In these 
cases, the filament will appear as an overly stretched spring, and the distance between the coils will 
be basically symmetrical, but greatly elongated. Discolouration of the filament may occur if the filament 
is hot when the envelope is broken. 
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Switches 


13.3.61 Aircraft switches come in a wide variety of designs with both lever-actuated and rotary-actuated handles. 
All switches should be documented as to position when found. If possible, switches should be recovered still in the 
mounting panel. This allows the investigator to retain the documentation and the relevance of other switches in the same 
panel. 


13.3.62 Whenever switch position becomes a factor in the investigation, the position of nearby switches should 
also be considered. Crew members reaching for a particular switch without correctly identifying the switch may 
inadvertently select the incorrect switch. This will not give them the response desired and will sometimes complicate 
their analysis of a condition due to their selection of unwanted actions. This will usually result in a question by 
investigators as to why the crew would not select an appropriate course of action (the desired switch) and, after nearby 
switches are considered, the realization that only a switch selection error was made. 


13.3.63 Switches that have been involved in fire may change their outward appearance due to melting of the 
insulating phenolic material. “As recovered” condition and position is important to assess the actual position of the switch 
prior to the fire. Internal examination of any suspect switch is necessary when fire involvement is apparent. 


Lever-operated switches 


13.3.64 Lever-operated switches may be two-position or multiple position switches. They normally will retain the 
last selected position unless subjected to impact from foreign objects as well as high impact loads in the direction of 
switch movement. However, these switches will have certain indications of these events. If impact forces are high 
enough to cause switch movement, other switches of the same design and movement direction should be similarly 
moved. If foreign objects impact the switch and change its position, a witness mark on the appropriate side may be 
identified. 


13.3.65 The size of the switch lever is important to the loads required to alter its selected position. Certain switches 
are designed for identification by touch and, therefore, have a larger top which facilitates a shape which can be identified 
tactilely. The larger the lever design, the more mass and the easier it can be displaced during impact loads. Specific 
design issues should also be considered: 


a) Lever-lock switches. These switches are designed so that the operator must lift the switch lever before 
moving the switch. This design is to prevent inadvertent activation. Lever-lock switches, therefore, are 
more resistant to impact force or foreign object repositioning and will usually have evidence indicating 
these forces were present. Some lever-lock switches are designed with the locking mechanism 
required for one direction of movement. The other direction will be designed with a ramp allowing the 
switch to be moved in that direction without positive lifting movement by the operator. In this case, it 
may be possible for impact forces or foreign objects to reposition the switch if applied in the direction 
of the ramp. 


b) Electrically-held switches. Some switches are designed with a spring force that keeps the switch in a 
specific position unless electrical power (sometimes from another circuit) is present that allows the 
switch to be held in position only as long as this power is available. Should power be interrupted, the 
switch will return to an unpowered position without operator action. The position of the switch in the 
unpowered state, therefore, is not evidence of operator selection. 


Ill-13-26 Manual of Aircraft Accident and Incident Investigation 





c) Guarded switches. Switches that are designed for use only under conditions that require specific 
decisions, such as in emergency procedures, will sometimes have the addition of a guard placed over 
the switch. In order to activate the switch, the operator must lift the guard then activate the switch. The 
guards may be safety-wired in the closed position to give positive indication of operator selection. In 
some designs, a slot in the guard may allow the guard to close around the switch after actuation. In 
others, the guard is solid and must remain open during switch use. In addition, these solid guards may 
be associated with unlocking or ramped lever-lock switches which will return to their guarded position 
merely by returning the guard to the “down” position. This also allows impact forces or foreign objects 
when aligned with the direction of return-movement to alter the switch selection identification since the 
forces to move the guard would be significantly less than to move the switch itself. Any guard safety 
wire must be evaluated for condition before determining the switch was not actuated before impact. 


Rotary switches 


13.3.66 Rotary selection switches usually retain their last selected position unless a foreign object strikes them. 
This will usually be very evident by the presence of the witness mark on the rotary switch. 


Circuit breakers 


13.3.67 Circuit breakers perform two roles in aircraft electrical systems. Their primary purpose is to provide 
overcurrent protection for the aircraft wiring. Their second function is to turn off power in electrical circuits that do not 
contain any other switching mechanisms. 


13.3.68 Circuit breakers can be the cause of an accident. They can open at less than rated current or fail to open 
under short circuit conditions. These failures can be caused by a variety of mechanical and electrical failures that make 
aircraft systems lose power or overheat. 


Construction 


13.3.69 The construction of thermal circuit breakers for aircraft depends on the manufacturer, rating, and 
application. The mechanical structures have changed over many years; therefore, age is also a factor. See 
Figure Ill-13-4 for a photo of one type of circuit breaker. 


Operation 


13.3.70 a) Manual operation. The button allows the circuit breaker to be opened manually. The position of the 
button also indicates the state of the circuit breaker. Pushing the button closes the circuit and latches 
the button mechanism. The button can be pulled out to open the circuit. The button shaft has a white 
band which is visible only when the button is in the extended (open) position. This is an additional 
indicator that the circuit breaker is open. 


b) Overcurrent trip. \f an overcurrent trip condition occurs when the circuit breaker is in the closed 
position, the electrical contacts open and the button pops out. The circuit breaker must be manually 
reset after tripping. This is done by pushing in the button until it latches. 


c) Trip mechanism. The moving contact assembly is an essential element in the overcurrent trip 
mechanism of the circuit breaker. The assembly contains the moving contacts which mate with the 
stationary contacts when the circuit breaker is closed. 
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Load current flows between the moving contacts through a bimetal strip in the center of the moving 
contact assembly. Two metal catch bars extend from the bimetal strip and rest against the button 
assembly. 


As the temperature of the bimetal strip rises, the metal component with the higher coefficient of 
thermal expansion (CTE) expands at a greater rate than the lower CTE component. This causes the 
strip to bend, separating the ends of the catch bars. When the catch bars separate far enough with an 
overcurrent load, a spring-loaded mechanism in the button assembly is released. The entire button 
assembly moves toward the front of the circuit breaker and away from the stationary contacts as the 
button pops out. Many circuit breakers have an adjustable screw for calibrating the overload trip 
current. 


A spring-loaded plunger forces the sliding contact frame away from the stationary contacts and opens 
the circuit. The plunger pushes the sliding contact frame against a stop near the button assembly. The 
circuit breaker cannot be re-closed until the bimetal strip and catch bars return to their normal 
condition. 


d) Trip time characteristics. The most important electrical data for the accident investigator is the time 
required for the circuit breaker to interrupt an overcurrent condition. 


Required operating time ranges for one type of circuit breaker are shown in Table III-13-3. Notice that 
the interruption times are longer for lower currents which provides inrush current capability for motor 
starting, transformer inrush, etc. This is accomplished with the natural time-overcurrent response of 
the bimetal strip. Higher currents will distort the bimetal strip and trip the circuit breaker faster than low 
currents. 


Table Ill-13-3. Overcurrent trip time requirements 















































TRIP TIMES AT 25° C 

Per cent of rated current Trip time 

115 Must hold: 1 hour minimum 
150 Must trip: 1 hour maximum 
200 2 to 20 seconds 

500 0.016 to 2.0 seconds 

1000 0.046 to 0.8 seconds 

TRIP TIMES AT -55°C 

135 Must hold: 1 hour minimum 
180 Must trip: 1 hour maximum 
TRIP TIMES AT 71° C 

90 Must hold: 1 hour minimum 
130 Must trip: 1 hour maximum 








Failure characteristics 


13.3.71 Aircraft circuit breaker operating mechanisms are reasonably reliable and fail-safe in their design. In 
addition, the condition of the operating mechanism is relatively unaffected by the electrical parameters of the load circuit. 
In contrast, the contacts can show signs of wear, arcing, and other features which relate to the number, type, and 
current level of electrical operations. The contact surfaces, therefore, contain information about the condition of the 
electrical equipment connected to the circuit breaker. For this reason, they will be the focus of this section. Contacts can 
be examined for failure characteristics by optical microscopy or Scanning Electron Microscope (SEM). 
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Contact wear. Contact wear is the result of arcing and/or mechanical abrasion. It results in a visible 
change in the appearance of the contacts which can provide clues about the number of operations 
and types of loading conditions. Excessive wear suggests repeated overcurrent tripping and may 
indicate abnormal electrical conditions in the loads supplied by the circuit breaker. Mechanical 
operation below the current rating does not cause significant contact wear. Usually circuit breaker 
contacts may be operated for up to 5 to 10 thousand cycles without showing abnormal wear. 


Material transfer. Material is transferred between mating contacts of a circuit breaker, due to the arcing 
that occurs at the contacts part under load. Their appearance can provide clues about the direction of 
current flow in DC circuits, and information about certain types of abnormal conditions. Metal transfer 
is caused by repetitive operation of breaker contacts in DC circuits. Material transfer is generally in the 
direction of conventional current flow. It is also possible for current to flow backwards through the 
circuit breakers during abnormal conditions, including conditions resulting from the accident sequence. 
This can happen in break-up and ground impact. These situations must not be overlooked when 
examining circuit breaker contacts. The appearance of material transfer may be obscured when the 
circuit breaker interrupts high DC circuits. 


Overcurrent. Circuit breaker contacts can be damaged by the interruption of currents significantly 
higher than their rating. Their appearance may indicate that overcurrent interruption may have 
occurred and provide clues about abnormal electrical events. Overcurrent damage can be caused by 
electrical failure of equipment, wiring shorts, and accidental electrical connections. Any of these 
events may occur during a mishap. Electrical system component and wiring failures can lead to 
overcurrent conditions which cause circuit breaker tripping. The basic mechanism resulting from 
overcurrent conditions is prolonged arcing. This causes melting and redistribution of the contact 
materials. Contacts take on a “splattered” appearance. The investigator should always examine all the 
contacts from a circuit breaker to increase the confidence level of any findings. Mating contacts should 
be properly identified as to their location and purpose in the existing circuitry. Most circuit breakers will 
have completed a number of normal cycles prior to an overcurrent event. This aging effect will mask 
the damage caused by more recent overcurrent events and complicate the investigation. The 
investigator may need to perform some test to recreate the damage patterns of the circuit breaker in 
question, when aging is an issue. 


Contact welding. Circuit breaker contacts occasionally weld together in the closed position. The 
condition is usually associated with a massive internal failure of the circuit breaker. A contact weld 
failure may indicate problems with the circuit breaker, or unusual surge currents in the load. 
Mechanical misalignment may also be a cause of welding. This causes a reduction in the mating area 
if the contact material solidifies before the circuit breaker can open. Failure occurs during a 
subsequent overcurrent condition or equipment failure. Metal migration can cause mating contacts to 
lock together mechanically and behave like welded contacts. Welded contacts will be quite brittle and 
may be damaged by the standard mounting procedures for metallographic specimen preparation. X- 
ray and visual verification of welding should be conducted before removing the contacts from the 
circuit breaker. 


Contamination. Contaminants inside the circuit breaker can cause the contacts to have a high 
resistance in the closed state. Contaminants can also cause arcing between the contacts, and can foul 
the mechanical operation of the breaker. Contaminants can be observed visually, or with the SEM. 
Identification may be done with the SEM or with infrared spectrography. Contaminants can also be 
trapped inside during manufacturing. Contamination can also be caused by severe arcing which can 
burn and dislodge housing materials. If conductive, the foreign matter may cause an electrical short 
between the contacts when the breaker appears open. If non-conductive, the material may prevent 
proper electrical contact when the breaker is closed. The materials may also prevent or impede the 
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proper mechanical operation of the circuit breaker. Environmental contaminants, such as dirt, 
moisture, and cleaning agents may enter the circuit breaker if the housing is not sealed properly, or if it 
is damaged after installation. 


f) Mechanical failure. Although electrical failures are more common, mechanical failures of circuit 
breakers can occur. The failures can be from abnormalities in the manufacturing process, wear, 
corrosion, or contamination obstructing the mechanism. Mechanical failure can be caused by 
corrosion of the internal mechanism of a circuit breaker. Internal contamination and manufacturing 
defects could also cause a mechanical failure. Mechanical component failure is not common, and 
should be verified by testing additional circuit breakers from the same manufacturing lot. X-ray 
examination of the circuit breaker before disassembly may reveal possible mechanical problems. 





Figure Ill-13-4. Photo of a 10A circuit breaker made by Klixon Division of 
Texas Instruments shown in the open position 


13.4 PRESSURIZATION AND AIR CONDITIONING SYSTEMS 


Superchargers and compressors 


13.4.1 These units supply charge air for air conditioning and pressurization. Both types of components are 
generally driven by engine accessory drives or gear boxes and may be disengaged in flight in case of malfunction. They 
can only be re-engaged after complete engine shut down. Both types should be examined for evidence of 
disengagement or drive failure, for proper lubrication, and for evidence of bearing failure or overheating. The impellers 
should be examined for blade damage which would indicate operation at the time of the accident. 
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Turbine engine bleed air system 


13.4.2 Air is bled from the compressor section of turbine engines in controlled amounts to provide air conditioning 
and pressurization, and ice and rain protection. Auxiliary power units utilizing turbine engines basically supply air for 
engine starting but may also be used to supplement the air conditioning system, particularly for ground operation. 
Pneumatic flow control valves, such as shut-off or isolation valves, air delivery valves, pressure reducing or modulating 
valves, crossfeed valves, temperature control valves and non-return or check valves, should be examined for valve plate 
positions and associated ducting connection integrity. The valve plate positions should be related to cockpit control 
positions. Bleed air pressure relief valves or panels should be located and examined for integrity. Control components 
such as over-temperature and over-pressure switches and thermostats should be located and preserved for further 
study should the need arise. 


13.4.3 If cabin fumes or carbon monoxide contamination are suspected as a feature in the accident, the air 
ducting, particularly that closest to the engine bleed, should be examined for smoke or oil deposits. Also those 
responsible for powerplant investigation should be alerted to the need to examine the engine oil seals; coordination with 
the Human Factors group is necessary in this situation. 


Air conditioning system 


13.4.4 This will include all flow control valves such as the cabin mixing valve, air delivery valves, pack valves and 
temperature control valves. Also included are freon compressors, condensers and evaporators; air cycle machines or 
cooling turbines; turbo compressors, water separators and heat exchangers. All valve positions and their condition 
should be documented and related to cockpit control positions. Air cycle machines and turbo-compressors should be 
examined for evidence of operation or malfunction. The condition of the bearings and impellers and their proper 
lubrication, as well as the ducting connections at these units, should be examined. 


13.4.5 Flow control valves are usually of two types: those which are operated by electric motors and those which 
are electrically controlled but pneumatically actuated. The latter type will, in general, return to the closed position if 
electric power is removed. It will be important to identify each of these valves in order to relate their positions to cockpit 
controls. The various electrical components of the control and warning circuits, such as thermocouples, mercury 
switches and pressure switches should be recovered, identified, labelled and preserved for testing or detailed 
examination should the need arise. 


Pressurization 


13.4.6 The heart of this system will be the mechanical electrical control components, usually found in the cockpit 
and electrical equipment racks, and the pressure control, outflow and emergency depressurization valves. These valves 
should be examined for condition and position, integrity of mechanical linkage, electrical connectors and pressure 
sensing line fittings. Look for any evidence of malfunction such as sticking valves or failures in diaphragms. Some 
pressure control valves can be tripped closed during emergency conditions such as fighting an underfloor compartment 
fire. The position of its linkage may point to such an occurrence. 


Ducting 


13.4.7 All ducting should be recovered and examined for being ruptured from overpressure or material defects 
and duct joint clamps should be checked for integrity. Heated air from a leaking or separated duct joint can have an 
adverse effect on adjacent equipment, electric wiring or fluid-carrying plumbing. Heat effect on wiring can result in erratic 
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operation of electrically operated components. Ducting interiors should be examined for evidence of smoke or other 
deposits. Duct insulation should be examined for discolouration which might indicate overheating, and for the presence 
of fuel or hydraulic fluid saturation resulting from leaks in plumbing adjacent to the ducting. 


13.5 ICE AND RAIN PROTECTION SYSTEMS 


13.5.1 This includes pneumatics and thermal de-icing equipment, windshield wipers and rain repellent. 


Pneumatic de-icing equipment 


13.5.2 Pneumatic air from vacuum pumps is used in the older airfoil de-icing systems. Examine the condition of 
de-icing boots, their supply lines and the position of their control valves. Examine the vacuum pump drive coupling and 
the fusible plug for integrity and the pump itself for evidence of operation at the time of the accident. 


Thermal de-icing equipment 


13.5.3 Airfoil thermal anti-icing is provided by heated air supplied by gasoline-fired heaters or by turbine engine 
bleed air. The combustion heaters should be examined for burn-through or signs of fire from leaking fuel. The engine 
bleed air anti-ice system will have flow control valves for wing and empennage and their positions should be 
documented and related to cockpit control settings. Airfoil anti-icing ducting should be examined for evidence of failure 
or loose joints which could allow hot air to be directed against wiring bundles, fluid lines and other components which 
could malfunction as the result of excessive heat. There have been cases where this heated air has charred the 
insulation on electric wiring. 


Windshield wipers and rain repellent 


13.5.4 Windshield wipers may be hydraulically or electrically operated. Check the position of wiper arms and 
check the position of wiper controls. There have been cases where malfunctioning hydraulic wiper motors have depleted 
available pressure to the point where landing gears could not be lowered and locked down in emergency situations. Rain 
repellent may be bleed air across the windshields or may be provided by a chemical from aerosol-type dispensers. 
These dispensers should be recovered and examined for evidence of bursting in flight. They are usually mounted in the 
cockpit and thereby constitute a hazard should they burst, even though the substance is non-toxic. 


13.6 INSTRUMENTS 


General 


13.6.1 All instruments should be recovered, their readings and condition documented and their connections 
examined. Pressure instrument hoses should be examined for evidence of leakage or poor connections; electrical 
connectors should be examined for loose pins or poor soldering of wiring; and wiring bundles behind instrument panels 
should be examined for shorts, overheating or chafed insulation. Clamped bundles should be examined under the 
clamps since this is a likely place to find worn insulation. 
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13.6.2 There are several methods which may be employed to determine the instrument readings at time of impact 
or loss of signals. These are (1) visual presentation as received, (2) microscopic examination of dial and pointer for 
evidence of impact marks, (3) internal examination of operating gears and mechanisms for evidence of impact marks or 
capture, and (4) electrical synchro readout. Where possible and applicable, all these methods should be employed to 
correlate findings. Since the instruments are extremely delicate, they are vulnerable to impact forces and heat. The 
calibration accuracies following a major accident cannot normally be determined. 


Fluorescent paint and use of ultraviolet lights 


13.6.3 Most of the instruments used in modern aircraft do not have dial faces and pointers that have been painted 
with fluorescent material. In these cases, the use of an ultraviolet light (black light) will prove to be of little value in 
determining if the pointer contacted the dial face. However, a few instruments still have yellow fluorescent markings. 
These instrument dials should be viewed under a “black light” for evidence of pointer dial contact. 


Impact damage to instruments 


13.6.4 The following information basically applies to all aircraft instruments. Instruments’ reaction to impact forces 
varies depending on the nature of the impact. Probably the most accurate instrument indications are those recovered 
from an aircraft that had one major frontal impact sufficient to destroy the instruments. Normally, the validity of the 
instrument reading is proportional to the impact damage incurred. Probably the most questionable readings are those 
from an aircraft which has sustained only light impact forces or has sustained multiple impacts. In all cases, the 
instruments should be analyzed and findings compared with known or suspected conditions existing at the time of 
impact. Instrument design is such that as long as the input signal is present, the internal mechanisms offer considerable 
resistance to change as a result of impact forces. Normally, if the “g” loading is sufficient to overcome the instrument 
torque and change the indication, damage will be incurred and the dial face or internal mechanism will reflect the 
conditions at the time of the high “g” loading. In all cases except instruments employing a gear train or other restraining 
device such as feedback potentiometers, the pointer may move when actually struck by a foreign object, but the amount 
of change is normally minute. If the input signals to some instruments are lost prior to impact or instrument capture, they 
may return to ambient conditions or zero depending upon the individual design and are discussed under the appropriate 


system section. 


g-force on pointers 


13.6.5 If the input signal is lost prior to capture on instruments that do not employ a gear train but normally retain 
their last indications, the following reactions can occur. If impact g-forces occur at a right angle to the pointer 
presentation, the pointer is rarely displaced greater than 90 degrees. Impact g-forces from other angles decrease the 
travel accordingly up to where no change occurs when the force is in the same plane as the pointer. Any circular 
movement of the indicator about the pointer axis can result in great changes in the pointer position. Instruments that 
employ a gear train or other type of restraint normally retain the conditions existing upon loss of input signal. The dial 
faces of most instruments are painted flat black. When the pointer contacts the dial face, a shiny mark in the paint often 
occurs. The pointer does not normally have sufficient mass to cut or imprint the dial face. Pointers which have counter 
weights for balance can leave an imprint when they impact the dial face. Extreme care must be exercised when a 
complete pointer shadow is noted. This pointer shadow may be the result of the paint fading due to exposure to direct 
sunlight while the aircraft is parked. These shadows are often noted on zero or the conditions existing upon aircraft 
shutdown. 
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Scratches on dial face 


13.6.6 The majority of scratches noted in the dial face are the result of broken glass. A study of the dial face will 
often reveal an area protected from glass breakage by the pointer. If the pointer is found, it can often be positioned 
where the glass scratches on the dial can be aligned with the scratches on the pointer. The position of glass cutting can 
often depict the direction the pointer was displaced. Examination of the dial face under magnification often reveals where 
the paint on the back side of the pointer has rubbed the dial face sufficiently to leave the pointer paint in the dial face 
paint and still not leave an obvious scratch on the dial face. 


Multiple pointer marks 


13.6.7 If multiple impact marks are noted, it must be determined which mark occurred first. Examine the shiny 
mark or balance weight impact mark. The initial pointer impact is normally more pronounced and fades in the direction of 
travel. Some instruments are spring-loaded and tend to return to zero upon loss of input signal. If this return spring 
produces an appreciable amount of torque, it will normally be sufficient to overcome “g” loading. Therefore, if multiple 
impacts are noted, the highest reading probably occurred first. Some instrument dial faces are mounted with screws 
through the dial face. Observe the back side of the pointer for evidence of the pointer contacting the screw head. If the 
scratch is present, the pointer must have passed over the screw. The absence of a scratch mark does not mean the 
pointer had not passed over the screw since the pointer may not have been distorted sufficiently to contact the screw 
head. 


Gear drives and synchros 


13.6.8 Instruments that have sustained considerable impact damage can be examined internally for evidence of 
gear teeth or operating mechanism impact marks. The various gears within the instrument have been designed so that 
each gear tooth is equivalent to a certain numerical or angular value of the information being presented. Since these 
gear teeth mesh with close tolerance, they often separate in such a manner that they become scratched or distorted. 
Magnification is often required to detect this point of disengagement. Since the gears are normally meshed at a point 
depicting a certain pointer presentation in relation to a low or high limit stop, the instrument mechanism can normally be 
reconstructed to depict the instrument reading existing upon gear separation. Care must be exercised in this area since 
the gear engagement could be off a few gear teeth at time of instrument overhaul. However, the indication would be the 
approximate indication existing upon gear separation. If the internal examination reveals that an output synchro motor 
appears to be captured, the angular degrees correlated to the appropriate value depicted in the applicable maintenance 
manual could provide an indication of the position of the instrument synchro. When applying electrical power to the 
instrument synchro, ascertain that the gear train or synchro shaft is captured to prevent the test synchro from driving the 
instrument synchro. Upon disassembly of any mechanism capable of changing positions, index the various parts so that 
reassembly in the exact positions can be accomplished. 


Pitot and static pressure systems 


13.6.9 All aircraft have both a pitot air and static air pressure system to supply pressure to all mechanical 
instruments furnishing airspeed, mach number, altitude, vertical velocity, mach hold, altitude hold, etc. Such pressure is 
also required for the air data computer and automatic pilot. The pitot-static system may be separate with the pitot 
pressure originating at the pitot tube and the static (vent) pressure terminating at the static ports. Some aircraft have 
both the pressure and static originating at a combined pitot-static tube. A thorough inspection of the pitot-static system 
should be accomplished. If a pitot tube becomes plugged due to foreign material or ice accumulation, all airspeed 
indications would be inaccurate. If the tube is totally blocked, such as when an insect is ingested into it or a nest is built 
in the opening, the airspeed indications would neither increase nor decrease except as affected by the static system 
upon changing altitude. In this case, an increase in altitude would result in a slight increase in airspeed indication 
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whereas a decrease in altitude would result in a lower airspeed reading. If a leak occurs in the pitot line in a pressurized 
area, the airspeed indicator will show a higher airspeed than existing. The only case wherein a malfunction pitot-static 
system can cause an erroneous high airspeed is a leak in the pitot line in a pressurized area or a completely plugged 
pitot line and an increase in altitude. If only the pitot tube inlet is blocked, the airspeed normally bleeds off through the 
pitot tube moisture drain hole. 


13.6.10 There have been cases of the static port becoming plugged due to icing, condensation within the tubing 
and water droplets adhering to the static ports. There have also been cases where maintenance workers have taped 
over static ports to facilitate aircraft washing or painting and failed to remove the tape. If a static port becomes plugged, 
the airspeed will indicate slow, and no change in altitude or vertical velocity will be noted. If a leak occurs in a static line 
in a pressurized area, the airspeed indicator will read slower than actual, the vertical velocity will show a descent and the 
altimeter will read lower than existing. 


13.6.11 Account for as much of the pitot-static system as possible and check for loose connections, disconnected 
lines, improperly flared tubing, cracked flare, over torque and obstructions that could have existed prior to impact. It 
should be noted that “B” nuts and fittings are often found loose as a result of impact or heat. Normally, if the fitting can 
be tightened an additional % to % turn, a loose fitting should be suspected and the system thoroughly analyzed. Final 
judgment should be reserved until all facts concerning the system have been accumulated and evaluated. 


13.6.12 The pitot static lines should also be examined for evidence of breakage or loose fittings. Some cases have 
been found where lines were buckled or twisted near a fitting because of improper installation or repair techniques. 
Examine flexible hoses behind the instrument panels for kinks or holes created by aging of the hoses. The position of 
the static source selector for normal or alternate sources should be recorded. 


13.6.13 Pitot heads should be examined for obstructions and an ohmmeter used to test the continuity of the pitot 
heater element. One way to check for pitot heater operation at impact is to look for vegetation or woody material packed 
into the tube at impact. If this material is charred or discoloured by heat, then it is an indication that the heater may have 
been in operation. 


Altimeters 


13.6.14 Altimeters normally indicate the pressure-altitude at the impact area unless damage or capture occurs. 
Normally, if the impact is insufficient to effect capture, the sector gear separates from the pinion gear and the pointer will 
go to an exceedingly high reading due to pointer mechanism spring preload. 


13.6.15 When analyzing the standard three-pointer altimeter, note the barometric setting and examine the dial face 
for evidence of pointer impact marks. Internal analysis of all altimeters basically consists of an examination of the gear 
train for gear teeth damage and the duplication of this damaged position on a like serviceable item. 


13.6.16 Analysis of the counter-pointer altimeter consists of examination of the dial face for a 100-foot pointer 
impact mark, the position of the 1 000-foot digital counter and barometric setting. 


13.6.17 Analysis of the counter-drum-pointer altimeter consists of an examination of the dial face for evidence of 
100-foot pointer impact marks, position of the 100-, 1 000- or 10 000-foot counters, barometric setting, position of 
function switch and the position of the “standby” wording. Where the word “standby” was visible prior to impact, the 
altimeter was operating directly from the static system. When the word “standby” is not visible, the altimeter receives its 
signal from an altitude transducer and is electrically presented on the dial. The indications noted are those existing upon 
the loss of electrical power or signal. Since the word “standby” is electrically actuated out of view, it will fall to the visible 
position upon loss of electrical signal unless capture occurs first. 
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13.6.18 Care should be taken when evaluating mechanical altimeters that have been exposed to fire damage 
without impact damage. The bellows within will expand due to the heat and the indications will increase accordingly. In 
some cases, altimeters have been recovered from the site indicating up to 100 000 feet due to this phenomenon. 


Airspeed indicators 


13.6.19 Airspeed indications will normally indicate the aircraft's speed down to zero indication unless damage or 
capture occurs. The airspeed noted can only be that existing at time of instrument capture and may be the minimum 
indicated during break-up. Any unusual or exaggerated aircraft manoeuvre prior to impact can affect the airspeed 
indications. 


13.6.20 When analyzing the single pointer indicators, examine the dial face for evidence of pointer/dial impact 
marks and internally for evidence of sector gear and pinion gear impact marks. Analysis of the pointer/drum/maximum 
allowable airspeed indicator should consist of an examination of the dial face for evidence of the airspeed and maximum 
allowable airspeed pointer contacting the dial face and a correctly adjusted maximum allowable mach marker. Examine 
the rotating drum for evidence of capture, scratches or bending on the exposed portion. Internally, examine the rotating 
drum for impact marks caused by the close proximity of the dampening magnet and the bellows balance weight. Check 
the sector gear, crown gear and pinion gear for tooth damage which could indicate the position of gears upon separation. 
Correlate this damaged area with a serviceable item. 


13.6.21 The airspeed/mach indicators normally consist of a double arrow pointer which depicts airspeed on a fixed 
scale in relation to mach number which rotates under the pointer. Examine the dial face for pointer-dials impact marks. 
Some airspeed/mach indicators have a large circular pointer with a “pie” shape cut out with two pointer tips. Examine the 
instrument dial face for evidence of glass breakage or impact material contacting the instrument dial face resulting in a 
clear area with the exception of the area of the pointer “pie” shape cutout. Examine the sector gear and pinion gear for 
impact marks. 


13.6.22 Some aircraft have digital readout ground and true airspeed indicators. These indicators are normally gear- 
driven and do not change position as a result of impact. If the visible portion of the dial is unreadable, mark the digits for 
reference and disassemble the mechanism to the extent necessary to read the undisturbed number and interpolate the 
numbers being presented. The readings taken will be those existing upon loss of electrical power. 


Vertical velocity indicators or vertical speed indicators 


13.6.23 Analysis of the vertical velocity indicator (VVI) or vertical speed indicators (VSI) consists of an examination 
of the dial face for evidence of pointer impact marks and an internal examination of the sector and pinion gear for gear 
teeth damage resulting from impact. The vertical velocity indicator has a built-in time-delay feature and may not keep up 
with the aircraft if abrupt changes are made. 


Compass systems 


13.6.24 Determine readings on heading-indicating instruments such as the magnetic compass, the course director 
indicator (CDI), the radio magnetic indicator (RMI), the gyrosyn compass and the air-driven directional gyro. Record the 
selected course and the setting index. Some of these units will incorporate integral gyroscopes while others will be fed 
by remote directional gyros. The gyros should be examined for evidence of operation. Disassemble the unit and look for 
rotational scoring on the rotor and the inside of the rotor housing from contact at the time of the accident. Instrument 
readings should be related to the aircraft heading at impact. The readings may not agree, in which case the compass 
system may have become inoperative at some time prior to the accident. It may also be the result of damage incurred 
during the crash. All of these conditions should be considered. 
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13.6.25 Some instruments such as CDI will have mileage indicators in one corner of the instrument while the 
aircraft may have a separate mileage indicator on the instrument panel. These mileage readings should be checked 
against the distance between the accident site and selected facility. VOR indicators can yield information as to the 
aircraft’s bearing from a selected VOR facility. This information may also be obtained from the pointers on the RMI. The 
RMI pointers may be used for both VOR and ADF bearings and will be selected by switches on the instrument panel. 
The selected functions should be determined to make a definite correlation with a selected facility. 


13.6.26 The magnetic compass should be examined for evidence of prior unserviceability such as an incorrect 
amount of fluid, and also for improper installation. It should be determined that the compass direction card is current, 
and it should be borne in mind that the operation of the compass can be influenced by the close proximity of ferrous 
material. 


Attitude instruments 


13.6.27 There are basically four different types of attitude indicators presently used. Probably the most simple in 
construction and presentation is the type J-8. This indicator is a self-contained unit presenting only roll and pitch 
information. Probably the most sophisticated is the three-axis attitude director indicator which receives information from 
the various systems to depict roll, pitch, heading, glide slope, turn and slip, pitch and bank steering, glide slope deviation 
and associated warning flags. Regardless of the complexity of the indicators, rationales and techniques used in the 
instrument analysis are basically the same. The information obtained is normally the conditions existing upon loss of 
electrical signal or power or instrument capture. The exception to this is the self-contained indicators such as the J-8 and 
certain miniature standby indicators. These self-contained indicators are capable of depicting the instruments’ attitude 
after loss of electrical power due to gyro inertia continuing to reposition the presentations. 


13.6.28 It is often possible to determine valuable information from attitude indicators regardless of the extent of 
damage. The internal mechanism of most attitude indicators contains high ratio gear trains to position the roll and pitch 
information. The sphere can be moved during impact when struck by foreign objects if the electrical signal is lost and 
capture has not occurred. Experience has shown that this movement by foreign objects is relatively minor and the 
amount of movement is in evidence by the analysis of the impact damage. 


13.6.29 Analysis of the indicators consists of an examination of the dial face (sphere) for evidence of the miniature 
aircraft striking the sphere, the bank pointer contacting the bank scale, the bank pitch steering bar contacting the sphere, 
the glide slope indicator contacting the masking and the various positions of the warning flags. Upon disassembly, the 
sphere should be inspected to determine if any of the masking, mounting screws, roll gimbal, gimbal mounting screws or 
roll drive gear mechanism had contacted the sphere. When these impact marks are properly aligned, the indications 
existing at instrument impact can normally be derived. Examination of the roll gimbal train often reveals sufficient 
damage to enable reconstruction of the roll being presented at impact. 


13.6.30 The glide slope, bank and pitch steering bars are normally d’Arsonval type meter movements. As such, 
they are capable of changing position with only slight movement upon loss of electrical signal. The position of the 
d’Arsonval meter movement pointers are normally meaningless unless the aircraft experiences one impact with 
instantaneous break-up. During the internal examination, the wiring and electronic circuitry should be inspected for 
evidence of broken wiring, loose connections, electrical overload and obviously failed resistors, transistors, coils, 
capacitors, etc. If the front presentation is missing, the dial face center can be approximated by stretching rubber bands 
between the instrument mounting holes or, if these are missing, stretch rubber bands between the four corners of the roll 
gimbal mounting flange and support bracket. Ascertain that the lines formed by the rubber bands are not distorted. If 
electrical power is not lost on initial impact the remote gyros for the indicators may tumble causing the indicator to 
present erroneous attitude information. The nature of the impact must be taken into consideration before a final decision 
on aircraft attitude at impact can be determined. 
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Turn and slip indicators 


13.6.31 There are some vacuum-driven turn and slip indicators in use with general aviation aircraft; however, the 
majority of indicators are electrically operated. This indicator has a self-contained gyro which is capable of operation for 
several seconds after loss of power. Unless it has been determined that the aircraft had one major impact, the readings 
noted would probably not be depicting the conditions existing upon impact. However, if one impact is in evidence, the 
Turn and Slip dial face should be analyzed for evidence of turn needle marks. The unit should be disassembled to 
determine if the gyro rotor shows evidence of rotational scrolling and if the gyro gumball is captured or shows evidence 
of impact marks. The conditions noted can be duplicated on a like indicator and the rate of turn established. Very little 
useful information can be obtained from the inclinometer, sometimes referred to as ball indicator, used to indicate the 
slip angle of the aircraft while in a turn. 


Angle of attack indicators 


13.6.32 The most common types of angle of attack sensors are the vane and probe. The vane type is shaped as 
an airfoil and aligns itself with the relative wind. The probe type detects relative wind by means of differential air pressure 
through a series of ports or slots in the front of the probe. As the sensor aligns itself with the relative wind, an electrical 
signal is transmitted to the cockpit indicator(s) either directly or through an air data converter. The vane type transmitter 
is probably more prone to changes during impact since the vane extends into the airstream and can be readily displaced 
when struck by objects. If the impact is sufficient to capture the vane without movement, the relative position can be 
determined by measuring the synchro output angular degrees and correlating these degrees to units in accordance with 
the applicable maintenance manual. The probe type is not as susceptible to changes as a result of impact. The internal 
transmitter consists of a potentiometer network with a minor gear train. The position of the potentiometer wiper can be 
measured and this resistance reading correlated to units of angle of attack in accordance with the instructions contained 
in the applicable maintenance manual. Analysis of the angle of attack indicators consists of inspecting the dial for 
evidence of pointer impact marks and position of adjustable climb, cruise and stall indices. Internal examination should 
be accomplished to determine the position of feedback potentiometer and correlate this resistive reading to the 
corresponding units as depicted in the applicable overhaul manual. The same applies to the synchro repeater indicator 
except the angular degrees of the synchro should be measured with a synchro tester and correlated to the vanes 
specified in the applicable manual. 


13.6.33 As angle of attack can be affected by yaw of the aircraft, most modern aircraft have sensors on both sides 
of the aircraft which evaluate not only the angle of attack, but the differences between them in order to display the best 
approximation of the true angle of attack. On aircraft equipped with only one sensor, of if there are two independent 
sensors and associated indicators, investigators should evaluate other evidence before accepting angle of attack 
information. 


Radio/radar altimeter 


13.6.34 This indicator normally consists of a synchro motor which drives a pointer through a minor drive chain. 
When a minor gear train is employed, the pointer is not easily displaced by impact forces. Examine the dial face for 
evidence of pointer impact marks. Measure the angular degrees of the synchro and correlate these degrees to altitude in 
accordance with the applicable manual. The reading noted should be the altitude existing above the terrain upon loss of 
electrical power or instrument capture. Check the radio altitude low warning light for illumination and the position of the 
“Off? flag. The “Off flag will become visible when the system is inoperative or electrical power is lost. 
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Integrated flight instrument systems (IFIS) 


13.6.35 The IFIS system consists of a flight director and vertical scale instruments. The flight director consists of a 
flight director computer, attitude director indicator (ADI) and a horizontal situation indicator (HIS). The vertical scale 
instruments consist of an airspeed-mach indicator (AMI) and an altitude-vertical velocity indicator (AVVI). 


Flight director computer 


13.6.36 The flight director computer receives navigation information from the navigation system and attitude 
information from the attitude gyro. The functions of the computer vary with the systems and with the number of inputs 
such as navigation aids, data link, inertial navigation, doppler, etc., that may be electronically processed by the system. 
Refer to the applicable system technical data for information relative to the capabilities of the system being investigated. 
The flight director computer is basically electronic in nature and very little information can be obtained. If impact damage 
is minor, the unit should be functionally checked. Damaged equipment should be internally inspected for evidence of 
electrical overheat, improper solder joints, broken connections, etc. 


Attitude director indicator (ADI) 


13.6.37 The ADI consists of an attitude indicator, turn and slip indicator, glide slope indicator, pitch and bank 
steering bars, attitude warning flag, glide slope warning flag and course warning flag. Analysis of this indicator is 
previously discussed under Attitude instruments (13.6.27 to 13.6.30). 


Horizontal situation indicator (HSI) 


13.6.38 The HSI is a combination of a heading indicator, radio magnetic indicator, course indicator and range 
indicator. The aircraft heading is displayed on a rotating compass card under the upper lubber line. The bearing pointer 
indicates the magnetic bearing from the aircraft to a selected ground station (VOR, TACAN or ADF) or a ground 
reference point (currently GPS but previously INS or Loran). The fixed aircraft symbol and course deviation indicator 
display the relative position of the aircraft to a selected course as depicted by the digital course dial and course arrow. 
When VOR or TACAN is being depicted, each dot on the course deviation scale indicates 5° of course deviation on most 
aircraft. When used with ILS, each dot usually, depending on the system, represents approximately 1%° of localizer 
deviation. The range indicator displays slant range in nautical miles to the selected TACAN or DME station. Some 
installations are designed so that the information is also being depicted when the ILS mode has been selected. When 
another mode is used, such as inertial navigation, GPS, etc., the applicable technical manual should be consulted to 
determine the function of each component. 


13.6.39 The course selector knob is used to select any of 360 courses. When a desired course is selected the 
course selector window will display a digital readout of the course selected and the head of the course arrow will point to 
the desired course. The TO-FROM indicator is a triangular shaped pointer. When the indicator points to the head of the 
course arrow, the selected course has been intercepted and is being flown. The heading set knob is used to position the 
heading marker to a desired heading. When the proper mode is selected on the flight director control panel, the heading 
marker can be slaved to the flight director computer. When the heading is set, the bank steering bar commands the bank 
attitude required to turn to and maintain the selected heading. 


13.6.40 The rotating compass card is gear driven and should retain the heading existing upon loss of electrical 
power or at time of instrument capture. The course set in the digital course window should be recorded and compared 
with the position of the course arrow. 


Part Ill. Investigation 
Chapter 13. Systems Investigation III-13-39 





13.6.41 Range indicator should be examined and the distance to the TACAN or DME station noted. Internal 
examination should consist of a general inspection of the electronic circuitry for evidence of electrical overheat, shorting, 
broken connections, etc. If the compass card is missing, the drive gears should be examined for evidence of gear teeth 
damage. The heading indication can often be determined with minor reconstruction using the impact damage as 
reference. 


Airspeed-Mach indicator 


13.6.42 The Airspeed-Mach indicator is a vertical tape display. Differential pressures are processed by an air data 
computer which converts the pressure inputs to electrical signals which drive the vertical tapes. Warning flags on the 
indicator scales appear when electrical power is lost or information from the computer is unreliable. 


a) Airspeed indicator. The airspeed indicator presents calibrated airspeed on a movable top scale 
readout against a fixed index line. The command airspeed slowing switch is provided to manually set 
the command airspeed marker. The value set is displayed in the command airspeed digital readout 
window. The marker is carried by the tape. When the command marker is in line with the fixed index 
line, it indicates the selected airspeed has been reached and is being maintained. When the marker is 
above the fixed index line, the selected airspeed has been exceeded and vice versa. When the slow 
switch is placed in the side detent, the airspeed command marker is aligned with and held to the fixed 
index line. This allows the command airspeed digital readout to display continuous airspeed to within 
one knot. When the slow switch is in the side detent, the command feature is lost and the command 
marker remains at the fixed index line. 


b) Mach indicator. The presentations of this indicator are similar to the airspeed section except Mach is 
being presented. There is no side detent for command Mach slowing. The command Mach marker is 
set and read in the command Mach digital readout window. The maximum allowable Mach marker is 
internally preset to the particular aircraft maximum Mach. When the aircraft reaches the maximum 
allowable, the marker is aligned with the fixed index line. 


c) Angle of attack indicator. The angle of attack indicator is a scale marked by symbols, units or degrees. 
The indicators which use symbols have a minimum safe speed symbol showing a stall warning, a final 
approach symbol which shows landing and flare angles and a zero angle of attack symbol. Other 
instruments display plus or minus angle of attack information. Some versions include an 
accelerometer tape and an acceleration digital readout. 


13.6.43 Analysis of the airspeed-Mach indicator for the purpose of accident investigation can provide valuable 
information. These tapes will retain the presentations existing upon loss of electrical power. If considerable damage has 
been incurred to the front section of the indicator, the indicator should be properly indexed and disassembled. Internally 
the tape may be intact. The positions of the tapes should be duplicated on a like instrument for the exact presentation or 
interpolated for an approximate indication. 


Altitude-vertical velocity indicator (AVVI) 


13.6.44 The AVVI displays altitude and vertical velocity by means of a moving vertical tape. Some indicators also 
display gross, cabin, and target altitude. The electrical signals to change the presentations are received from the air data 
computer. If the information presented is unreliable or if electrical power is lost, a warning flag will appear. The various 
information presented is vertical velocity moving scale, vertical velocity index, altitude scale, altitude warning flag, 
vertical velocity fixed scale, fixed index line, target altitude marker, gross altitude scale, command altitude marker, gross 
altitude marker, vertical velocity moving scale, cabin altitude marker, digital target altitude readout, digital command 
altitude readout, barometric pressure readout window, command altitude allowing switch, and barometric pressure set 
knob. 
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a) Altimeter. Calibrated altitude is depicted by a movable tape readout against a fixed index line. Some 
scales are marked numerically each thousand feet and with 10 equal spaces between the numerals. 
Later indicators have separate scales reading thousands of feet and hundreds of feet for more precise 
altitude presentations. The barometric setting is a digital readout. A command altitude slowing switch 
is provided to manually set the command altitude marker. The command marker rides the tape, and 
when the marker is aligned with the fixed index line, it indicates the desired altitude has been reached 
or is being maintained. Some indicators have a side detent slowing switch. When this switch is 
actuated, the command marker aligns with and holds to the fixed index line and the command readout 
window will continuously present a digital display of the altitude. 


b) Vertical velocity indicator. A movable vertical velocity pointer indicates rate of climb or descent against 
a fixed tape scale. When these limits are reached, the vertical velocity pointer becomes fixed and the 
aircraft’s vertical rate of change is read against a movable tape scale. Analysis of the VVI is identical 
to the Airspeed-Mach Indicator in that the tapes will hold the readings existing upon loss of electrical 
signal. If the visible tapes are not discernable, disassemble the unit to the extent necessary to view 
undamaged or readable tape and interpolate the reading being presented. 


Electronic flight instrument system (EFIS) 


13.6.45 Most current generation aircraft present flight information to the crew via “flat panel displays” or 
“multifunction displays” generated on a screen. The data for display is generated by the same type components in the 
more traditional instrument systems, but is artificially generated for display. Aircraft with multiple screens can customize 
the arrangement of instruments according to pilot preferences or organizational policy. However, because the displays 
are dynamic representations of data, once electrical power is lost all displays vanish. No mechanism is present to 
provide clues to conditions at impact. 


13.6.46 The same technology that generates the images for the EFIS has given rise to the use of non-volatile 
memory in the generating components. It is to these “memory chips” that the investigator must turn to find the clues. 
(See 13.15 and Chapter 7 for a discussion on recovering data from non-volatile memory.) 


Engine instruments 


13.6.47 During the investigation of all aircraft accidents, it is extremely important to determine the actual 
performance of the aircraft engine(s). A properly conducted instrument analysis can often point to the operating 
conditions of the engine existing upon impact or loss of input signal. This is especially true on instruments recovered 
from an aircraft which has experienced one major hard impact. The majority of engine instruments are repeaters of the 
instrument transmitters and employ no gear train. In this case, the instrument readings can change during impact if the 
electrical signal is lost and capture has not occurred. Some indicators will return to mechanical zero or ambient 
conditions upon loss of electrical power unless capture occurs. All these peculiarities must be taken into consideration 
during the instrument analysis. Instrument transmitters should also be recovered and analyzed for position of various 
gears and actuating mechanisms at time of impact. 


Tachometers 


13.6.48 Tachometer indicators receive their electrical signal from the tachometer generator and operate 
independently of the aircraft’s electrical system. Tachometer indicators are normally spring-loaded and tend to return to 
the zero position at an exceptionally rapid rate upon loss of input signal unless capture occurs. However, these 
indicators are very delicate and impact damage often causes the main and vernier gears to jam. Examination of the dial 
face often reveals evidence of the pointer or pointer balance weight contacting the dial face. Internal analysis consists of 
an examination of the gears for capture and the location of the main pointer mechanical stop. The position of the 


Part Ill. Investigation 
Chapter 13. Systems Investigation IlI-13-41 





mechanical stop should be marked and the main pointer mechanism rotated to the stop to determine if the pointer has 
slipped on its shaft. If the pointer is missing, the mechanical stop can be used as a pointer reference; i.e., when the 
mechanical stop is reached, the pointer is normally just less than zero per cent rpm. Some tachometer indicators employ 
two pointers. One pointer presents the per cent rpm from zero to 50 per cent. When 50 per cent is reached, the pointer 
picks up a larger pointer which reads from 50 to 110 per cent. When the indicator is examined internally, the relative 
position of the pick-up mechanism should be noted in respect to a known position such as 50 per cent to determine if the 
pointer has slipped on its shaft. If the pointers are missing, one can be reinstalled at the 50 per cent pointer pick-up point 
and then returned to the position recovered and the per cent rpm read directly from the dial face. Since tachometer 
indicators are spring-loaded to the zero position and the exact time of capture is unknown, the reading should be 
considered the minimum rpm at impact. 


Engine pressure ratio (EPR) 


13.6.49 The engine pressure ratio system determines the ratio between the engine inlet pressure and exhaust 
pressure. The resultant reading is the power factor of the engine. All pressure ratio indicators are basically the same in 
design in that they are synchro repeaters employing only a minor gear train or no gear train at all. As such, their 
readings should be determined based upon the previously furnished information regarding synchro repeater indicators. 
Some EPR indicators have digital readout for target cruise and take-off and are manually set by the flight crew. These 
readings have no direct connections to the EPR indications. One design uses a capacitor gate feedback circuit whereas 
the other uses a fulcrum and jackscrew to position the feedback transmitter. 


13.6.50 Both designs employ major gear trains within the internal mechanism. If the impact is severe, the capacitor 
gate often contacts the base support structure. The contacted position can be noted and simulated in the shop on a like 
serviceable transducer and the EPR read directly on the shop indicator. If damage does not occur, the capacitor gate 
position can change to a higher EPR reading upon loss of electrical signal due to spring tension in that direction. Care 
must be taken in this area to determine if the internal mechanism is free and capable of changes. The transducer using 
the fulcrum-jackscrew arrangement will retain the indications existing upon loss of electrical signal. It is almost 
impossible for impact to change the position of the fulcrum on the jackscrew. The position of the fulcrum on the 
jackscrew should be noted and duplicated in the shop on a serviceable unit and the EPR read directly on the shop EPR 
test indicator. 


13.6.51 Since EPR is a function of the ratio between the inlet and exhaust pressure (Pt), any obstructions to the 
inlet or exhaust pressure pickup probe (similar to a pitot tube) will affect the indications accordingly but electrical power 
must be available to the EPR system. Examine the pickup probe for evidence of being plugged or distorted. Obstructions 
to the inlet probe will cause an increase in EPR reading whereas an obstruction in the exhaust pickup will result in a 
lower EPR reading. An Air Florida Boeing 737 crashed on takeoff from Washington National Airport in Washington, D.C. 
in 1982 and this was attributed, in part, to the fact that the EPR inlet probe had ice accumulation from ground operations. 
The crew perceived the EPR reading which was incorrectly high causing them to take off with less than full available 
power. 


Fuel flow indicating systems 


13.6.52 The fuel flow indicating system consists of a fuel flow indicator, transmitter and normally a 26 VAC power 
supply. The fuel flow indicators are synchro repeaters. Some employ gear trains whereas others do not. Analysis of 
synchro repeaters not employing gear trains consists of examination of the dial face for evidence of pointer impact 
marks and electrical position of the syncro. The indicator’s susceptibility to changes as a result of impact fall into the 
category of other synchro repeaters previously discussed. Indicators employing gear trains should retain the indications 
existing upon the loss of electrical power. 
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13.6.53 Analysis consists of standard dial face examination and internal examination of a feedback potentiometer 
can be correlated to fuel flow based upon the data contained in the overhaul technical manual or duplicated on a like 
serviceable item. There are basically three types of fuel flow transmitters presently used. One transmitter employs an 
impeller, rotatable vane and synchro transmitter. The impeller is driven electrically at a constant rpm. The fluid travelling 
through the impeller continues through a rotatable vane causing it to turn and align with the flow from the impeller. The 
synchro is attached to the rotatable vane shaft which in turn transmits a signal to the indicator in the cockpit. The 
rotatable vane is normally spring-loaded and will return to the zero position upon loss of flow unless capture occurs. The 
impeller will not rotate at the required rpm if electrical power is lost. It can turn, however, as the result of fuel flowing 
through the vanes. Since the impeller and rotatable vane are in extreme close proximity with the transmitter housing, 
impact damage often causes the mounting pivots to break. This allows the vanes to contact the housing leaving impact 
marks. Heavy scrolling marks on the impeller imply that electrical power was available to the transmitter. Since the 
rotatable vane only moves in relation to the amount of flow, impact damage noted can be correlated to the position of the 
mechanical stop and either duplicated on a like serviceable transmitter and the fuel flow read directly on a fuel flow 
indicator, or the synchro electrical degrees can be read and converted to fuel flow in accordance with the applicable 
technical data. 


13.6.54 Another type fuel flow transmitter consists of a vane which opens and closes in response to the fuel flowing 
through the transmitter. A synchro transmitter is attached to the vane which sends a signal to the fuel flow indicator. This 
vane is also spring-loaded to the low limit stop. Analysis consists of examination of the internal flow cavity for evidence 
of the vane contacting the housing. Most frequent points of impact are at the vane tip and behind the vane pivot point. 
Once the impact mark is found, the position noted can be correlated to fuel flow reading in a manner similar to the 
impeller type previously discussed. 


13.6.55 The third type transmitter consists of an impeller which spins as the fuel flows through the vanes. This 
turning establishes a rate which is converted to a DC voltage. When the calibrated rate of flow has passed through the 
transmitter, DC voltage is applied to a stepping relay which subtracts the amount of fuel remaining from a preset 
indicator in the cockpit. There is very little useful information that can be derived from the transmitter. However, the 
indicator is a digital readout and should depict the approximate amount of fuel remaining at time of electrical power. 


Exhaust gas, turbine inlet, tail pipe and cylinder head temperature indicating systems 


13.6.56 These systems all operate on the thermocouple principle of voltage being generated by a bimetallic pick-up 
being exposed to heat. This voltage is transmitted to a voltage-reading d’Arsonval type meter which has a dial face 
calibrated in degrees centigrade. No useful information can be derived from the wiring or thermocouple pickup. These 
indicators offer considerable opposition to changes as a result of impact forces as long as the electrical signal is 
available to the indicator. If electrical power is lost prior to capture or if capture does not occur, the pointer normally 
swings through a wide arc when only slight movements to the indicator are induced. Analysis of the indicator consists of 
an examination of the dial face for evidence of pointer impact marks. Upon disassembly, the pointer field magnets 
should be examined for evidence of the pointer balance arm impact marks. This balance arm is normally in the direction 
of the pointer tip. Keep this in mind when correlating the impact marks to indicator presentation. 


13.6.57 If the pointer and balance arm are destroyed, disassemble the permanent magnet assembly and note the 
position of the moving coil. The coil is normally in the same plane as the pointer. Duplicate the captured position on a 
like indicator and read the temperature directly on the dial face. If damage is sufficient to destroy all references toward 
the pointer tip, the reading may be 180 degrees from the one observed. Take all information into consideration and pick 
the one or two most logical, based upon other known or suspected factors. It should be kept in mind that as long as the 
thermocouple system remains intact, the indicating system will present ambient temperature regardless of the condition 
of the aircraft's electrical system. 
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13.6.58 Some later style temperature indicators employ a pointer driven by a major gear coupled with a digital 
readout and a temperature switch which sends a signal to a temperature recorder. Some even incorporate a “hot” 
warning flag which becomes visible when a preset temperature is reached. Analysis of this style of indicator consists of 
examination of the dial face for evidence of pointer impact marks and position of digital readouts. Internal examination 
consists of noting the position of the temperature switch. The applicable maintenance manual will normally give sufficient 
information to interpolate the switch position in relation to the temperature being depicted. Due to the design of this style 
indicator, the readings noted are those existing upon loss of aircraft electrical power since they require electrical power 
for operation. 


Pressure indicating systems (oil, fuel, water, hydraulic, etc.) 


13.6.59 These indicators are normally synchro repeaters employing no gear train. Synchro repeaters’ reaction to 
impact damage has been discussed previously. Analysis consists of an examination of the dial face for evidence of 
pointer impact marks and synchro electrical position. The pressure transmitters usually employ a sector gear to position 
a pinion gear on a synchro transmitter shaft. The sector and pinion gear should be examined to determine if impact was 
sufficient to cause gear teeth damage. If damage is noted, the gear positions should be duplicated on a like serviceable 
item and the pressure read directly on an applicable indicator or the angular degrees of the synchro should be measured 
and correlated to pressure in accordance with the applicable equipment technical manual. Unless capture occurs, these 
transmitters will return to zero upon loss of pressure input due to spring preload and bellows collapsing. 


Vertical tape engine indicators 


13.6.60 Some transport aircraft use vertical tape displays to depict engine pressure ratio, low and high pressure 
rotor rpm (N1 and N2), exhaust gas temperature and fuel flow. These indicators are designed to return to mechanical 
zero within approximately two seconds upon loss of electrical power and an “OFF” flag will appear. If these indicators 
are found captured, but the exact time of capture cannot be definitely established, the readings noted would be the 
minimum engine performance at the time of instrument capture. Analysis of these vertical tape indicators is basically 
accomplished as previously described in 13.6.35 to 13.6.44. 


Position indicating instruments (cowl flap, intercooler, exhaust nozzles, etc.) 


13.6.61 The majority of these indicators are resistance bridge circuits, d’Arsonval meter movements or synchro 
repeaters. Analysis is basically identical to other type indicators previously discussed. 


Fuel quantity indicating systems 


13.6.62 Regardless of the circumstances surrounding the nature of the accident, it becomes important during the 
investigation of most accidents to determine the amount of fuel on board the aircraft and the fuel distribution. The 
majority of the fuel gauging systems are capacitance circuits designed to measure fuel density and convert this factor 
into pounds. Where a capacitance bridge circuit is used, there is normally a feedback circuit in the indicator to balance 
the bridge. In order to accomplish the balancing or nulling, numerous gear training and a feedback potentiometer are 
incorporated into the indicator. When this type arrangement is used, the indicators should retain the indications existing 
upon loss of electrical power. 


13.6.63 If the aircraft breaks up around the fuel tanks prior to the loss of electrical power, the following changes to 
the fuel quantity indications can occur, but at a slow rate. If the tank unit or shielded leads break, the indicator will return 
toward zero. If the compensator lead breaks, the indications normally increase. If the tank unit or compensator leads are 
shorted to ground, the indications will decrease. If the shielded lead is shorted to ground, the indications will increase. If 
any combinations of the tank lead, shielded lead and compensated lead short together, the indications will decrease. 
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The rate of change from full to empty is approximately 35 seconds for all cases with the exception of a shielded lead 
shorted to ground. In this case, the total time for travel is approximately 85 seconds. Since the time between impact and 
loss of electrical power is normally in fractional seconds, the amount of change on the fuel quantity indicators should be 
insignificant. There are exceptions in that a prolonged break-up pattern could result in electrical power being on the 
aircraft during break-up. 


13.6.64 Some aircraft may still use the resistance bridge fuel gauging system with float actuated transmitter. If such 
a system is used, the indicators will normally return to mechanical zero upon loss of electrical power. Analysis of the 
indicator would consist of an examination of the instrument dial face for evidence of pointer impact marks, keeping in 
mind that the pointer is subject to oscillations by impact forces. 


Aircraft clocks 


13.6.65 Aircraft clocks are very delicate instruments and will normally “stop” when exposed to moderate impact 
forces or heat. Analysis should consist of examination of the dial face for pointer impact marks and check of the pointers 
for being loose on their shafts. Limited information can be derived from internal examination. 


Position indicators (flap, landing gear, doors, spoilers, surface, etc.) 


13.6.66 The majority of these indicators are synchro repeaters without gear trains and are subject to change as the 
result of impact force. Analysis should consist of an examination of the dial face for evidence of pointer impact marks 
and a measurement of the synchro electrical position keeping in mind the possibility of instrument changes during 
impact. Most gear position indicators will return to an intermediate position upon loss of electrical power. Instrument 
changes from “UP” or “DOWN” to the intermediate position occur at an exceptionally rapid rate. 


Hydraulic pressure indicators 


13.6.67 Some hydraulic pressure indicators are synchro repeaters of the hydraulic transmitters and do not employ 
gear trains while others are direct reading instruments using a contracting or expanding bourdon tube to position a 
pointer on a calibrated dial. Analysis of the synchro repeater indicators is the same as other synchro repeater indicators 
previously discussed. 


13.6.68 Analysis of the direct pressure reading indicator is somewhat different in that certain circumstances can 
cause the readings to change during impact. Since these indicators are not electrically operated, the indicators will 
continue to read as long as the system is intact. If the instrument separates from its mounting position with the tubing still 
attached, the tubing can distort the bourdon tube sufficiently to change the instrument indication. If the indicator is 
subjected to post impact fire, the heat can cause the bourdon tube to expand, resulting in a higher reading. 


13.6.69 Probably the only time that direct pressure indicators provide useful information is when one instantaneous 
impact occurs. The dial face should be examined for evidence of pointer impact marks or capture position and this 
information correlated to other known or suspected conditions of the applicable system. The pressure transmitter for the 
synchro repeater indicators can often provide useful information if impact is sufficient to cause extensive damage to the 
internal mechanism. Analysis could consist of an internal examination of the sector and pinion gears for evidence of 
pointer impact marks. If impact marks are detected, their position should be duplicated on a like service item and the 
pressure read directly on an applicable system indicator or the angular degrees of the synchro measured and 
transposed to pressure in accordance with the values contained in the applicable technical orders. 
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Electrical system meters (volt, frequency, load, etc.) 


13.6.70 These indicators operate on a d’Arsonval meter movement concept. When electrical power is available to 
the indicators, some opposition changes due to impact “g” force is inherent. If the electrical power is lost and capture 
does not occur, the pointers are free to oscillate and normally return to mechanical zero. Analysis should consist of an 
examination to determine the position of the meter coil assembly. The position of the coil assembly should be duplicated 


on a like instrument to get the relative pointer position. 


13.7 NAVIGATION SYSTEMS 


Radio communication and radio navigation equipment 
Transmitters and receivers 


13.7.1 During cockpit documentation, the frequency selector panels should be examined for selected frequencies. 
These frequencies should be correlated with radio facilities in the area. Also, check volume control knob positions on 
both the selector panels and the audio selector panels to determine the amount of volume set on the equipment. 


13.7.2 The VHF radio equipment for both communication and navigation can be examined visually to determine 
pre-selected frequencies by removing the front cover and reading the frequency on two indicators. Should the front 
panel be missing, the crystal bank selector switches should be examined to determine which crystals were selected. The 
two crystal values can be given to the manufacturer who can then supply the selected frequency. Another method is to 
examine the frequency selector rods and cam positions, also taking note of the positions of the tuning slugs. When 
similar equipment is available in a radio shop, it can be channelled until the cams and slugs agree in position to the 
component in question; then the frequency can be read off the good unit. 


Automatic direction finders 


13.7.3 Determine the band and frequency selected from the ADF control panel, then endeavour to correlate these 
findings with a nearby low frequency facility. If the ADF is not operable, the positions of the variable tuning condensers 
should be recorded by scribing on the condenser plates to hold the relationship, then another receiver of the same type 
can be tuned until the condenser plates are in the same relationship and a good approximation of the frequency can be 
obtained. 


13.7.4 The ADF needle on the RMI can be documented as to an indicated bearing and this can be related to the 
bearing of the accident site to the selected facility. This can be accomplished in conjunction with the VOR needle 
bearings indicated and thus provide a check of the navigation by the flight crew, particularly on en-route accidents. It 
may be possible to derive bearing information from the position of the movable ADF loops depending on their condition. 


Distance measuring equipment (DME) 


13.7.5 The cockpit channel selector position should be recorded. The distance module in the front portion of the 
unit can provide a mileage indication; some units will also provide an indication of the selected channel but this will not 
be true of solid state equipment. Equipment utilizing moving components can also provide an indication as to whether or 
not the unit was locked on to a channel or not. 


13.7.6 Determine the frequency selected for VOR facilities and check to see if that facility is equipped for DME 
response. The DME channel assigned to that frequency can then be compared to that found on the DME equipment. 
Compare the distance found on the DME to the distance between the accident site and the selected facility. 
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Antennas and cables 


13.7.7 Antenna cable connections should be examined for signs of damage or poor connections. Transmitter 
antennas should be examined for evidence of lightning strikes or static discharges. 


On-board self-contained systems 


Inertial navigation systems 


13.7.8 Aircraft equipped with inertial navigation systems receive input from three-axis gyros that translate gyro- 
precession inputs into motion. This enables the navigational computation of routing with either rhumb line or great circle. 
Inertial navigation systems are prone to precession errors if a mechanism does not update the gyro position or the crew 
does not identify position errors and recalibrate. 


Ring laser gyro systems 


13.7.9 Some aircraft are equipped with navigation systems which utilize ring laser gyro inertial reference units. A 
ring laser gyro is an angular rate sensor which measures the deflection of a circular beam of light within the unit. It has 
no spinning gyros and thus is highly reliable. While extremely accurate in flight these units must be precisely aligned on 
the ground prior to takeoff. The alignment may also be updated in flight. In some investigations, it may be necessary to 
examine the initial position data and the alignment or update procedures used by the operator. Manufacturer bench test 
facilities are required to perform functional tests of ring laser gyros. 


Global positioning systems (GPS) 


13.7.10 The use of navigation by means of global positioning systems is becoming commonplace. The global 
positioning system utilizes a network of highly accurate navigation satellites. An aircraft equipped with the proper 
receiver can simultaneously receive signals from several satellites and, through geometric triangulation, determine 
current position. This system provides greater accuracy and eliminates some of the constraints of ground-based 
navigation systems. Manufacturer support would be required to evaluate the accuracy and functionality of GPS 
components. 


13.7.11 Global positioning systems routinely use electronic displays. As such, their internal non-volatile memory 
must be evaluated for data. The visual display retains no information once power is lost. It may be possible to apply 
power for a data-readout, but this should be done under laboratory controls. 


13.7.12 Investigators should be alert for the presence of GPS systems when evaluating other navigation means. 
Due to the accuracy of the systems and the instantaneous calculations of destinations and position, pilots have 
erroneously relied on these systems when reportedly flying more traditional radio navigation. Approaches attempted 
using GPS data and relying on published approaches not certified for GPS may result in positioning errors and 
subsequent accident contributions. 
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13.8 FLIGHT CONTROL INVESTIGATION 


Introduction 


13.8.1 Accident investigation of aircraft flight control systems is time consuming. Since the flight control system is 
distributed throughout the structure of the aircraft, the task of identifying, recovering, and inspecting all flight control 
components is a large one. Before beginning, review the aircraft maintenance history for evidence of flight control 
problems or recent work accomplished in this area. Do not develop preconceived notions based on what is found in the 
records. Later, the thorough investigation of aircraft records will take a considerable amount of time. Then assemble all 
the technical data needed to identify flight control components at the crash site. Investigative flight control data may 
have been developed by the manufacturer. If so, make sure it is available. Experienced flight control technicians are 
essential to this part of the investigation. They are familiar with the system and the appearance of its various 
components. Remember that impact forces and fire damage can drastically alter the shape and appearance of parts. 
Therefore, having part numbers readily available is important. Armed with the technical data and a good flight control 
maintenance technician, begin your search at the crash site. 


Flight control systems 


13.8.2 Since the flight control system of each type of aircraft is significantly different, the detailed investigation of 
three typical systems are discussed. The three systems are a mechanical flight control system, a hydro-mechanical 
system, and a hydroelectric (fly-by-wire) system. Stability and control augmentation and autopilot systems are discussed 
separately in this chapter. 


13.8.3 All flight control systems control motion about the longitudinal, lateral, and the vertical axis of the aircraft. 
The flight control surfaces can be divided into two major groups, the primary and secondary (or auxiliary) control 
surfaces. 


13.8.4 The primary and secondary control surfaces are controlled and activated through many components which 
include actuators, hinges, brackets, bellcranks, push-pull tubes, tie rods, cables, pulleys, balance weights, and bob 
weights. In helicopters, the collective and cyclic control systems and components, including the main and tail rotors, are 
an integral part of the flight control system. Attempt to identify and recover all of these components at the crash site. 


Primary flight control surfaces 


13.8.5 The primary control surfaces are ailerons, elevators or stabilators, and rudders. Most all control surfaces 
are similar but vary in size, shape, method of attachment, and method of activation. They are usually made of an 
aluminium alloy or composite material built around a single spar member or torque tube. Ribs are fitted to the spar at the 
leading and trailing edges, and are joined together with a metal strip. On some aircraft a control surface may serve a 
dual purpose. For example, one set of control surfaces, the elevons, combines the function of both ailerons and 
elevators. Flaperons are ailerons which can also act as flaps. A stabilator is a movable horizontal tail section which 
serves both as a horizontal stabilizer and an elevator. 


Secondary flight control surfaces 


13.8.6 The secondary control surfaces consist of trim tabs, balance tabs, servo tabs, flaps, spoilers, speedbrakes, 
and leading edge devices. Their purpose is to reduce the force required to activate the primary controls, to trim and 
balance the aircraft in flight, to reduce landing speed or shorten the length of the landing roll, and to change the speed of 
the aircraft in flight. Be sure that all primary and secondary control surfaces are accounted for during the investigation. 
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Basic components 


13.8.7 Some basic components are common to many systems. Here are some descriptions. 
Cable assembly 
13.8.8 The conventional cable assembly consists of flexible cable, terminals (end fittings) for attaching to other 


units, and turnbuckles. 


Pulleys 


13.8.9 Pulleys are used to guide cables and also to change the direction of cable movement. Pulley bearings are 
sealed, and need no lubrication other than the lubrication done during manufacture. Brackets fastened to the structure of 
the aircraft support the pulleys. Cables passing over pulleys are kept in place by guards. The guards are close-fitting to 
prevent jamming or to prevent the cables from slipping off when they slacken due to changes in temperature. Pulley 
tunnels are a typical place for foreign objects to become jammed. See Figure III-13-5. 


Fairleads 


13.8.10 A fairlead is another type of cable guide made either from a non-metallic material (such as phenolic) or a 
metallic material (such as soft aluminium). The fairlead completely encircles the cable when it passes through holes in 
bulkheads or other metal parts. Fairleads are used as cable guides in a straight line through or between structural 
members of the aircraft. They should never change the direction of the cable more than three degrees. See 
Figure IlI-13-6. 


Pressure seals 

13.8.11 Pressure seals are installed where cables or rods move through pressure bulkheads. The seal grips tightly 
enough to prevent excess air pressure loss but not enough to hinder movement of the cable or rod. 

Control rods 

13.8.12 Control rods are used as links in the flight control system to give a push-pull motion. Therefore, they are 
also known as push-pull rods. They may be adjusted at one or both ends. Control rods consist of a tube having threaded 
rod ends. An adjustable antifriction rod end, or rod end clevis, attaches at each end of the tube. The rod end, or clevis, 
connects the tube to flight control system parts. The checknut, when tightened, prevents the rod end or clevis from 
loosening. See Figure Ill-13-7. 


Bellcranks 


13.8.13 A bellcrank changes direction of motion and transmits motion to such parts as control rods, cables, and 
torque tubes. See Figure III-13-8. 
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Figure Ill-13-5. Typical pulley arrangement 
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Figure Ill-13-6. Fairleads 
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Torque tube 


13.8.14 A torque tube is installed when an angular or twisting motion is needed in the flight control system. See 
Figure IIl-13-9 
Turnbuckles 
13.8.15 A turnbuckle is used in cable control systems to adjust cable tension. The turnbuckle barrel is threaded 


with left-hand threads inside one end and right-hand threads inside the other. When adjusting cable tension, the cable 
terminals are screwed into either end of the barrel an equal distance by turning the barrel. After a turnbuckle is adjusted, 
it must be safetied. 


Jackscrew 


13.8.16 A jackscrew is a mechanism adjusted by threading action to apply pressure on a surface. Jackscrews are 
normally actuated by an electric motor, and are used to position flap and trim tab control surfaces. 


Hydraulic actuated control surfaces 


13.8.17 In a hydraulic actuated system, the pilot's input is used to open valves directing hydraulic fluid to actuators, 
which are connected to the control surfaces by control rods. The actuators move the control surface to the desired flight 
condition. The inputs can be controlled manually through a power transmission quadrant or electrically as in a fly-by-wire 
system. 


Accident site investigation 


13.8.18 No matter what type of flight control system is being investigated, the on-site work that must be 
accomplished is similar. If flight crew members survived, their testimony is an excellent starting point, although many 
expert investigators do not want to review testimony until after they have completed their initial site survey. If there are 
no witnesses to the mishap, initial indications of flight control involvement may become evident during the first visit to the 
crash site. 


a) Identify, tag, and photograph, as is, as much of the system as possible. During this part of the 
investigation, be sure to document, both in your notes and with photographs, any observations which 
appear to be unusual. 


b) If you must disconnect portions of the system, index by marking each side of the connection so you 
can reconstruct. Document all such disconnects. 


c) Mark the position of any component that might be free to move during wreckage recovery. 


d) To adequately investigate the entire system, lay out the component fragments on a full scale drawing 
or sketch. This also helps you determine how much of the system you have recovered. Set up a 
secure area in which to do this, and bring in for detailed examination everything that was found at the 
crash site. 
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Figure Ill-13-7. Typical control rod 





Figure Ill-13-8. Typical bellcrank 
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Figure Ill-13-9. Typical torque tube arrangement 
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The mechanical system 

13.8.19 The simplest flight control system is strictly mechanical. The aileron, elevator, and rudder control surfaces 

are connected to the pilot's stick or yoke by cable assemblies operating through control rods, bellcranks, and torque 

tubes. 

General 

13.8.20 After identifying all control surfaces and as much of the flight control system as possible at the crash site, 


begin a detailed examination. During the course of the investigation, make every attempt to establish: 


a) 


that all surfaces, including trim tabs, are accounted for; 

the presence of any foreign objects; 

the continuity of each flight control from the stick or rudder to the control surface; 
the position of each flight control surface at the time of impact; and 


the position of trim tabs at the time of impact. 


Detailed investigation 


13.8.21 Make your layout of the flight control system in a secure area, using full scale diagrams if possible. 
Proceed as follows: 


a) 


Closely inspect the structure adjacent to all flight control surfaces for contact marks that would indicate 
the position of the surface at impact. Using contact marks for control surface position at impact 
assumes that the impact with the ground occurs in such a short period of time (milliseconds) that the 
actuating system and the mass inertia of the control surface do not allow significant movement during 
initial impact. However, marks made by control surfaces or adjacent structure can also quite possibly 
happen during post-impact structural break-up, giving false or useless indications. 


Closely inspect all flight control cables for evidence of jamming, binding and pre-impact failure. 
Jamming or binding of cables during flight can usually be detected by fore and aft markings on 
adjacent structures. Markings in only one direction normally identify jamming as a result of ground 
impact. Similarly, a broken or disconnected fitting should leave significant markings on adjacent 
structures if the failure occurred in flight and the surfaces were moved by airloads or an allied cable 
system. Cables are normally made of strong material (such as stainless steel) whereas pulley 
assemblies, sleeves, and adjacent aircraft structure are normally aluminium alloy. Therefore, x-ray 
spectrum analysis can determine if there have been unusual metal transfers indicating a cable binding 
or a jam. The same x-ray analysis helps to determine if a foreign object found in the wreckage might 
have caused a control jam. Know what happens to each control surface if a control cable breaks. In 
some aircraft there is no control deflection. Telex cable can fail for a number of reasons. Examples: 


1) Severe galling due to contaminants, such as hydraulic fluid, entering the terminal end fittings. The 
contaminant can harden over time and cause chafing which, in turn, could result in excessive 
friction near the terminal end. The friction can put a high load on the inner core (cable ribbon) 
causing it to bow and then bind and/or jam. 
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2) The fitting pins or pin holes could fail. 
3) The inner core (cable ribbon) could fail. 
4) Any cable attach point could fail. 
5) The cable could fail as a result of improper installation. 
6) Foreign objects could cause the cable to jam or fail. 


Note.— Microscopic and scanning electron microscopic examination of broken cables can identify fatigue 
and other crack failures. When requesting such examination, the cables should be left as intact as possible, and any 
attached or embedded hardware included. This helps to specifically identify the cable. 


c) 


Examine the continuity of the aileron control system: 


ensure that the bolts through the aileron hinges are properly installed; 

check the attachment of the aileron push rods; 

check the aileron bellcrank attachment; 

check any direct and crossover aileron cable attachment to the aileron bellcrank; 

check all pulley brackets, pulley assemblies and attach bolts; 

check all control system sprocket and bearing supports for missing or damaged teeth; and 


check the control columns for integrity. They are sometimes connected for aileron control by 
chains and turnbuckles. 


Examine the continuity of the elevator control system: 


ensure that the elevator assembly is properly attached to the horizontal stabilizer or elevator; 


ensure any balance weight arms and balance weights are properly attached to the elevator 
assembly; 


check the elevator push rod assembly; 
check the elevator bellcrank and cable attachment; and 


check the pulleys and pulley bracket. Pulleys should be properly guarded. Check the sleeves 
covering the outer race of the pulleys for any unusual scratches or marks. 


Examine the continuity of the rudder control system: 


1) 
2) 


3) 


check that all bearings, bolts, and nuts are in place; 
check for proper attachment of rudder push rods to rudder bellcrank; 


check the security of the rudder bellcrank support brackets and the rudder bellcrank attachment; 
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4) check the cables through the horizontal stabilizer for proper attachment; 


5) check that the rudder pulley brackets are properly attached with pulleys, bolts and nuts in place; 
and 


6) check that pulley guards are in place. 


f) If during the course of this examination, any of the components are found to be disconnected, make 
sure that the bolts are still in place, or that the disconnect points show firm evidence of having been 
stripped or of having received other damage at impact. If no such evidence can be seen, strongly 
suspect that the disconnect occurred in flight, and determine the consequence of such an event and 
how it fits the mishap scenario. 


Investigating the hydro-mechanical system 
General 


13.8.22 The typical hydro-mechanical system employs aircraft primary flight controls, to include a stabilator or 
elevator, rudder, and ailerons and/or spoilers. The controls are activated by irreversible hydraulic power cylinders. 
Artificial feel systems provide simulated aerodynamic control stick and rudder pedal forces due to the lack of 
aerodynamic feedback forces from the power control cylinders. The feel systems have trim actuators which, through the 
power cylinders, move the entire control surface. Artificial feel is usually provided by springs and bob weights. Most trim 
systems employ jackscrews or separate trim actuators. 


a) The aileron power cylinders receive metered hydraulic fluids from control valves. The control valves, in 
turn, are controlled by push-pull rods, operating through bellcranks and the control stick. The power 
cylinder piston rod is joined at one end by a yoke that is attached to the aircraft structure. The cylinder 
portion of the power cylinder is attached to the aileron. 


b) Stabilator and elevator system components include the control stick, push-pull rods, cables, 
bellcranks, control valves, and power cylinders. When the control stick is moved longitudinally, the 
motion is transmitted by push-pull rods to the bellcrank. It is then transmitted by a cable assembly to 
another set of push-pull rods. The second set of push-pull rods activates the control valve, which 
meters hydraulic fluid to the power cylinder. 


c) The rudder control system consists of the rudder pedals, push-pull rods, cable assemblies, bellcranks, 
a rudder damper, control valves, and a power cylinder. When the pedals are moved, the motion is 
transmitted by the push-pull rods, bellcranks, and cable assemblies. This positions the control valve 
meters and routes hydraulic fluid to the power cylinder, positioning the rudder. It is usually possible to 
have limited mechanical authority over the rudder in a hydraulic system failure. 


Detailed Investigation 


13.8.23 The detailed investigation of the hydro-mechanical system is very similar to the mechanical system. From 
the system description above, it is evident that much of the system is made up of cables, pulleys, bellcranks, control 
rods, and torque tubes. These components must be recovered and examined in the same manner as described in 
13.8.19 to 13.8.21. The major difference is that the crew actions do not directly position the control surfaces but instead 
direct hydraulic fluid through control valves to actuators that do the job. Therefore, additional evidence of flight control 
function and surface position may be available. Actuator arms may be captured at impact and extension can be 
measured to determine control position. Here are a few points that apply directly to the flight control system. 
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a) Check that electrical and hydraulic power were available to the flight control system. 


b) If actuators are cable operated, during separation from the aircraft at impact the uneven parting of the 
cables usually drives the actuator to the end of its travel. 


c) After hydraulic lines have been severed, piston-actuated components may assume a misleading 
position. Some actuators will fully extend, some will retract with the loss of hydraulic pressure. 


d) The purity of the hydraulic fluid is critical. Contamination such as particles of sand, dust balls, or silicon 
oil, when combined with the hydraulic fluid, can cause actuators to malfunction or result in 
uncommented inputs. 


e) Many hydraulic servo mechanisms have servo valves that are centred by springs and return to their 
deenergized or lock positions as electrical or hydraulic pressure decays. 


f) If the actuator barrels are made of steel instead of aluminium, the impact is less likely to mark the 
interior. The probability of any impact marks is directly proportional to the force of the impact. 


g) Always look into the possibility of bench-checking servos and hydraulic actuators for proper operation. 
You cannot always tell just from appearance if such a check is possible or not. 


h) Always photograph, x-ray, and index actuators before taking them apart or cutting the barrel. 


The hydro-electrical system 


13.8.24 The state of the art fly-by-wire flight control system is a quadruplex command and stability augmentation 
system. It employs a fly-by-wire concept. The pilot-initiated control inputs are transmitted via quadrex electrical signals 
rather than mechanical linkage. The wiring is separated by branches. There are two to four branches down each side of 
the aircraft to prevent loss of the system to damage in one area. Cockpit controls with minimum displacement 
transducers (providing an essentially fixed stick and rudder pedal arrangement) convert the pilot's commands into 
electrical signals. These electrical command signals are processed by a flight control computer along with electrical 
signals from rate gyros, accelerometers, and the air data system which supplies dynamic and static pressures along with 
angle of attack. The processed electrical signals are transmitted via wiring to the hydraulic power cylinders, which then 
supply mechanical outputs to the flight control surfaces. 


13.8.25 Since the fly-by-wire system uses hydraulic actuators to position the control surfaces, the standard 
procedures discussed in this chapter still are valid. However, once you have recovered all the information available from 
the actuators, your investigation turns to one of electrical analysis and data retrieval. 


Jackscrew investigation 


13.8.26 Recovered jackscrews indicate the control position by counting the number of threads exposed beyond the 
associated nut or gear box. This kind of mechanism normally is not free to move or change after impact. Technical data 
is available to translate the number of threads exposed to a control position. 
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Trim systems 


13.8.27 Trim systems are either mechanically or electrically controlled. The mechanical system uses control rods, 
pulleys, bell cranks and torque tubes. Techniques for the investigation of such a trim system are similar to those 
discussed for a mechanical flight control system. In the electrical system, a trim tab actuator may be used to position the 
tab surface. If so, tab position may be determined by actuator arm measurement. If measurement of the overall length is 
possible it is more accurate because it eliminates rigging tolerances. If the trim is positioned by a jackscrew, count the 
number of threads exposed as explained in the previous section. In an electric trim actuator, it may also be possible to 
check the trim stop setting. Trim actuators are often severely damaged at impact. Consider the use of radiography or 
x-ray to determine actuator position. 


Autopilot systems 


13.8.28 The typical automatic flight control system (AFCS) is an electro-mechanical or hydroelectrical system 
designed to provide stable, accurate, and coordinated flight manoeuvres without interfering with manual control. Most 
maintain any aircraft heading and attitude selected within the AFCS limits and correct for any deviation from the selected 
heading or attitude of the aircraft within those limits. System components normally include a control panel and amplifier, 
accelerometers, and rate gyro sensors. The control amplifier receives signals from the various sensing elements in the 
system and supplies power to the flight control components. Flight control surfaces are positioned either through 
separate power cylinder control servos or through servos integral with the power cylinder themselves. Since the majority 
of AFCS components are electrical, they produce little useful information relative to their functioning capability at impact. 


a) Recover as many of the components as possible and attempt to bench check them for normal 
operation. 


b) Document the position of switches on the AFCS control panel remembering that impact can reposition 
select and power switches. Some AFCS functional switches return to the off position when electrical 
power is lost. Check for illumination of any cockpit warning lights associated with the AFCS. 


c) Check all AFCS servos and associated power cylinders. If possible, check the servo disconnect 
features to ensure their capability to disconnect. 


d) Determine the depth of the autopilot investigation by AFCS implication in the mishap scenario. If 
AFCS involvement is suspected, and components cannot be bench checked, expert assistance is 
required to determine if failures occurred before or as a result of impact. 


Control augmentation systems (CAS) 


13.8.29 If the aircraft includes a control augmentation system (CAS), it is usually superimposed on the hydro- 
mechanical flight control system. The typical CAS is a dual channel, three-axis system. The CAS responds to electrical 
signals generated by forces applied to the control stick and to rudder pedal position. These signals modify the control 
surface deflections commanded by the hydro-mechanical flight control system to provide the desired flying qualities. The 
CAS also provides increased damping in all three axes. Since CAS inputs are applied directly to the control actuators 
and the inputs are due to force and require no control motion, with the CAS on, the aircraft is fully controllable with the 
loss of any or all mechanical linkages. The dual channel feature turns any axis off when a failure occurs. 


a) Analyze the CAS control panel for switch position, remembering that impact can reposition the 
selection switches. 


b) Check for illumination of any cockpit lights associated with the CAS. 
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c) Check all CAS servos, and attempt to determine their operating condition. 
d) Check all servo power cylinder connections. 


e) Consult the experts if it is suspected that CAS components were malfunctioning before impact, and 
the malfunction is related to the mishap. 


Note.— CAS systems operate at a very high number of cycles per second. Unless the impact is very high 
speed, it is doubtful much valuable information can be obtained. 
Stability augmentation systems (SAS) 
13.8.30 Stability augmentation systems (SAS) employ rate gyros and lateral accelerometers to sense changing 
motion about or along their respective axis, and send signals to the surface controls to oppose any deviation from 
normal flight attitude. The action decreases any tendency of the aircraft to oscillate in roll, yaw or pitch, or to develop 


lateral forces which cause the aircraft to slip or skid. 


a) Using technical data, investigate the authority of the SAS to determine if it is capable of producing 
control surface positions that could be a factor in the mishap. 


b) Check position of SAS control panel switches remembering that switches may be repositioned as a 
result of impact forces. 


c) Check for the illumination of any SAS control or warning lights at impact. 
d) Check all servos to the power cylinder connections. 
e) Check all SAS servos and attempt to determine their operating condition. 


f) Consult the experts if it is suspected that SAS components were malfunctioning before impact, and 
the malfunction is related to the mishap. 


Note.— SAS systems operate at a very high number of cycles per second. Unless the impact is very high 
speed, it is doubtful much valuable information can be obtained. 
Miscellaneous components 
13.8.31 Electrically operated components such as solenoid valves, control valves and warning circuits should be 
examined also. Some valves will be operated automatically when a power control unit or other device malfunctions or 
fails. These valves should be recovered and their positions documented. Document the condition of any artificial feel 
system and dampers. 


Flight control components — functional testing 


13.8.32 Hydro-mechanical and electro-hydro-mechanical components such as power control units, control boost 
units and stabilizer screw jacks may be functional tested as a complete unit. 
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13.8.33 Special tests may be devised which will provide more information than the standard tests. An example 
would be testing the capabilities of the stabilizer screw jack under certain conditions of tail loading. When the screw jack 
assembly is mounted in the test fixture, the screw jack can be statically loaded in tension and compression to simulate 
the application of full elevator deflection in both directions at assumed air speeds. The hydraulic, electrical and 
mechanical controls can then be exercised to determine the ability of the screw jack to operate under such conditions. 


Fly-by-wire systems 


13.8.34 Fly-by-wire flight control or engine control systems require a combination of techniques for analysis: control 
input sensors and transducers must be evaluated for proper function; wire must be evaluated for continuity and condition; 
control servos should be examined for electro-mechanical evidence; and finally, the actuators need to be examined as 
hydraulic, pneumatic, or electrical rotary systems as appropriate. 


13.9 FIRE DETECTION AND PROTECTION SYSTEMS 


Fire detectors 


13.9.1 Fire detectors may be of the “fire wire” type or they may be individual detectors wired in series. The fire 
warning circuits should be checked for continuity, grounding or shorting and the detector relay boxes should be tested 
for operation. 


Note.— Fire detection and extinguisher systems are becoming increasingly complex, therefore 
consideration may need to be given to using the specialized knowledge and test equipment of the manufacturer. 


Fire extinguisher systems 


13.9.2 These systems may utilize carbon dioxide, freon or more commonly halon. Usually, fire protection is 
provided for the engines and the auxiliary power units; however, many of the older aircraft also provide protection for 
under floor compartments. Aircraft utilizing combustion heaters for air conditioning and thermal anti-icing will have heater 
fire protection also. The latter will usually be of the carbon dioxide type. 


13.9.3 Fire extinguisher bottles should be recovered and examined for their state of charge. If they are found to 
be charged, arrangements should be made for safe storage to preclude personnel injury. If they are discharged, the 
control heads should be examined to determine whether or not the discharge was intentional. In some cases, each fire 
bottle has the ability to direct the discharge to two areas as selected by the crew member. In this case, it is likely that 
one electrical-explosive squib is still functional and should be de-armed by appropriately trained personnel. Provisions 
are made for thermal release and this function should also be examined. Indicator discs are installed in the fire bottle or 
near the extinguisher installation area to provide evidence of intentional or thermal discharge. These should be checked 
for condition. 


Portable extinguishers 
13.9.4 Portable extinguishers use carbon dioxide or halon. They should also be recovered and examined in order 


to determine whether or not they were used. If used, every attempt should be made to determine whether use occurred 
before the accident or during the rescue operations. 
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13.10 PRESSURIZATION SYSTEM 


13.10.1 Aircraft that routinely fly above 3000 m (10 000 ft) are generally equipped with an oxygen system fed 
through masks or cannulas (typically for smaller aircraft), or are pressurized by an environmental control system (ECS) 
using air provided by compressors or bleed air. Bleed air extracted from the engines is compressively heated and then 
cooled by passing it through a heat exchanger and air cycle machine commonly referred to by aircrews and technicians 
as “the packs system”. 


13.10.2 Most modern commercial aircraft today have a dual channel electronic controller for maintaining 
pressurization along with a manual back-up system. These systems maintain air pressure equivalent to 2500 m 
(8 000 ft) or less, even during flight at altitudes above 13 000 m (43 000 ft). Aircraft have a positive pressure relief valve 
in the event of excessive pressure in the cabin. This is to protect the aircraft structure from excessive loading. Normally 
the maximum pressure differential between the cabin and the outside ambient air is between 7.5 and 8 psi (51.7 and 
55.2 kPa). If the cabin were maintained at sea level pressurization and then flown to 35 000 feet (10.7 km) or more, the 
pressurization differential would be greater than 9 psi (62 kPa) and the structural life of the airplane would be limited. 


13.10.3 The air conditioning system provides a constant flow of pressurized, conditioned air to the cabin. Normally, 
a small amount of air leaks overboard through door seals and other openings. Pressurization and ventilation is controlled 
by modulating the outflow valve and the overboard exhaust valve. It is always an emergency if a pressurized aircraft 
suffers a pressurization failure above 3000 m (10000 ft). If this occurs, the pilot must immediately perform an 
emergency descent and activate oxygen masks for everyone aboard. Two recent accidents, one involving a commercial 
airliner in Europe and the other a business jet in the United States, are believed to have been initiated by pressurization 
problems causing the flight crews to become unconscious. 


13.10.4 If a pressurization problem is suspected, the components of the pressurization system should be 
investigated. The investigation should establish if the lack of pressurization was caused by air leaking from aircraft or if 
the pressurization system did not provide sufficient air to pressurize the aircraft. This includes inspecting the pressure 
cabin and seals and ducts for cracks or punctures. The proper functioning of the pressurization controller and the system 
valves, including the outflow valve, should be established. Also, the condition of the air cycle machine and different 
sensors of the system should be inspected along with the integrity of system ducts. 


Cockpit oxygen system 


13.10.5 In modern commercial aircraft the cockpit oxygen system uses quick-donning diluter demand 
masks/regulators located at each crew station. Oxygen is supplied by a single cylinder which is usually located in the 
forward cargo compartment. One cylinder supplies oxygen to all of the flight crew members. Oxygen pressure is 
displayed on the indicator located in the cockpit. Oxygen flow is controlled by a regulator that is mounted on the oxygen 
mask. The regulator may be adjusted to supply 100% oxygen. The function of the masks should be inspected and all 
lines and fittings from the oxygen cylinder to the mask. Since the crew oxygen system is an emergency system it does 
not have to be redundant; therefore, one cylinder supplies oxygen to all of the flight crew members. During routine 
maintenance oxygen cylinders are inspected for quantity and replaced if needed. Investigators should check the on/off 
valve of the cylinder to ensure it was placed in the open position during replacement. Flow check of the oxygen mask is 
a pre-flight item but cylinders have been found in the past with closed on/off valves. 


Oxygen cylinders 


13.10.6 Flight crew and portable passenger breathing oxygen cylinders should be accounted for to ensure that 
none of them had burst prior to the accident. Any cylinder which remains charged should be placed in safe storage to 
prevent personnel injury. Where possible, check the cylinder contents to ensure that the gas is oxygen and not some 
toxic material. 
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Passenger cabin oxygen systems 


13.10.7 Emergency oxygen from chemical oxygen generators is provided to passengers of pressurized aircraft to 
protect them from drops in cabin pressure. Chemical oxygen generators are not used for the cockpit crew. Overhead 
masks and oxygen generators are provided for each row of seats. If a decompression occurs, panels are opened either 
by an automatic pressure switch or by a manual switch, and masks are released from a compartment in the overhead 
panel. If a pressurization problem is suspected in the investigation, evidence should be sought for proper activation of 
the system and whether the masks had been used by the passengers. Furthermore, the chemical oxygen generators 
should be inspected for serviceability. 


13.11 LANDING GEAR SYSTEMS 


13.11.1 Taken as a whole, the landing gear system includes the brakes, antiskid, wheels, and tires. From an 
investigation point of view, it is more practical to break these into two systems: the landing gear itself and the brakes, 
antiskid, wheels, and tires. 


13.11.2 Problems with extension or retraction of the landing gear are usually, but not always, unrelated to problems 
involving acceleration or deceleration of the aircraft. 


13.11.3 The landing gear must absorb the shock of landing. This is often accomplished with air-oil (oleo) struts 
where hydraulic oil is forced through an orifice under controlled rates to absorb the landing forces. Some aircraft use a 
trailing beam strut which is essentially an oleo strut mounted on a lever arm, others may use a steel spring to which the 
wheel assembly is mounted. 


Fixed landing gear 


13.11.4 If failure of the landing gear occurs, the struts, mounting bolts, and fuselage mounting structure should be 
examined. Determine if the correct bolts were installed, if corrosion has reduced the strength of the material or if the 
components failed due to fatigue. If the inspection of the landing gear system does not detect any problem, a hard 
landing should be suspected. 


Retractable landing gear 


13.11.5 Modern retractable landing gear is operated either hydraulically or electrically. Some of the older aircraft 
designs even have manually operated landing gear. The systems include some device for preventing inadvertent 
retraction on the ground. On some aircraft, this safety feature can be deliberately overridden by the pilot. The system 
also includes some emergency method of lowering the gear. In the case of hydraulically operated landing gear, this may 
be an alternate source of hydraulic pressure, pneumatic pressure from emergency air bottles, or a mechanical method of 
releasing the uplocks and allowing the landing gear to fall of its own weight. In the case of an electrically operated 
landing gear system, the emergency extension usually occurs by mechanical unlocking and free-fall. Some systems 
require manual cranking after the gear is released in order to fully extend and engage the downlock. 


13.11.6 In the cockpit, there is a combination of indicators and lights to allow the pilot to monitor the position of the 
landing gear. In addition, a warning horn sounds if the throttles or power levers are retarded below a certain point and 
the landing gear is not down. Sometimes the position of the flaps will also affect the sounding of the warning horn. 
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13.11.7 Most modern landing gear incorporates “squat” or weight-on-wheels switches which close when the 
landing gear is down and the weight of the plane is on the gear. Many other aircraft systems can be wired through these 
squat switches and do not operate correctly if the squat switch malfunctions. 


13.11.8 Retractable landing gear can present additional problems. Landing gear operation usually induces pitching 
moments and drag which should be considered by the investigator. If the landing gear is retracted or extended at 
airspeeds greater than the placard speed, structural damage may occur, especially regarding gear doors and fillets. 
Landing gear have three positions; up, in transit, and down. Examination of the uplocks and downlocks should reveal 
evidence as to their position. If no damage occurs to these locks, the gear was probably in transit. Correlate this 
information with other indicators such as actuators, landing gear handle, gear position lights or indicators. 


Uplocks and downlocks 


13.11.9 Uplocks and downlocks may be mechanical links that are moved by retraction or extension action to an 
over-center position. Frequently on smaller aircraft, an electrical solenoid-operated pin may be engaged on the downlock 
to prevent the landing forces from causing the over-center link from rotating and allowing gear collapse. The first action 
of moving the landing gear selector handle would be to disengage the appropriate lock and allow the system to move the 
gear through the in-transit position. 


13.11.10 Some aircraft with hydraulic mechanisms do not have traditional mechanical over-center locking link. They 
use the system hydraulic pressure to hold the gear in the selected position. This may be true in the “Down” position 
where the hydraulic actuator doubles as a shock absorber for the aft moment on touchdown. 


13.11.11 Large aircraft frequently do not have uplocks and allow the hydraulic pressure to be released once the 
landing gear doors have closed. In this case, the gear may, in fact, drop to rest on the locked landing gear doors during 
cruise. If an emergency extension is necessary, the doors are unlocked and the gear is free to drop into position. 


Wheels 


13.11.12 Aircraft wheels are manufactured from magnesium, aluminium alloy, or steel alloy. They operate in a high 
stress environment and are subject to corrosion and mechanical damage during tire mounting and normal service. 
Almost all modern wheels are of the split half type wherein the two halves of the wheel are bolted together below the tire 
beads. Due to manufacturing tolerances, it is essential that the two wheel halves be matched by both part number and 
manufacturer number. The wheels contain the inflation valve for the tire, the fusible plugs designed to melt and release 
tire pressure, and may contain a pressure relief valve designed to vent excessive inflation pressure. 


13.11.13 Aircraft wheels are designed with the aircraft maximum operating weight, maximum landing weight, 
expected landing conditions and maximum performance stopping limitations in mind. In their normal operating 
environment, aircraft wheels are not expected to last the life of the aircraft and may be time or cycle limited. 


Brakes 


13.11.14 Aircraft brakes are devices for absorbing mechanical energy and converting it to heat. Most modern aircraft 
brakes are of the single or multiple disc type. In the single disc type, one or more hydraulically actuated piston “pucks” 
apply force to a rotating brake disc which is attached to the wheel assembly. In the multiple disc type a stack consisting 
of one or more stationary discs (stators) are hydraulically pressed against one or more rotating discs (rotors). The 
amount of pressure is usually a function of the pressure applied to the brake pedals in the cockpit. In multi-place aircraft, 
using one set of pedals may isolate the other set. In some aircraft, both sets may be used simultaneously and the effect 
is additive; that is, the total pressure applied to the brakes is the sum of the pressures applied to both sets of pedals. 
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13.11.15 Some aircraft may have an emergency brake provision which uses pressure supplied by either brake 
accumulators or emergency air bottles. A characteristic of emergency brake systems is that there is a limited number of 
brake applications, but that each brake application is effective until released. 


13.11.16 The use of aircraft brakes produces a considerable amount of heat. Most aircraft flight manuals have brake 
energy limit charts which plot the generation of heat as a function of gross weight, speed, stopping distance, etc. Since 
maximum temperatures are not generated within the wheel assembly until several minutes after brake application, and 
since the effect of subsequent brake applications is additive, it may be necessary to consider previous taxi distance and 
time when calculating peak brake temperatures. 


13.11.17 The problem of excessively hot brakes can lead to other problems. Modern wheel assemblies have fusible 
plugs which will melt and release the tire pressure before the tire fails. In some systems, the brakes may generate 
enough heat to melt the O-ring seals in the hydraulic brake pistons and create a hydraulic fluid leak. If this occurs, a fire 
invariably follows as the brakes are also hot enough to ignite normal hydraulic fluid and most probably “fire resistant” 
hydraulic fluid as well. 


13.11.18 In any case, the best set of aircraft brakes made can only stop the wheels from rotating. The actual 
stopping force applied to the aircraft comes from the friction between the tires and the runway. 


Tires 


13.11.19 Aircraft tires are designed to withstand very high speeds and very heavy static and dynamic loads — 
intermittently. By contrast, an automobile tire is designed for much lower speeds and loads, but it is designed to run 
continuously at a stabilized temperature. An aircraft tire will fail under continuous operation. 


13.11.20 Tires are identified first by size and ply rating. The ply rating is an index of tire strength, and is not 
necessarily related to the number of actual plies in the tire. Almost all tires in current use are tubeless. The strength 
characteristics of a tire (by size and ply rating) are specified in terms of maximum speed, maximum load, maximum 
sustained braking pressure, and approximate load required to bottom a properly inflated tire against the wheel rim. 


13.11.21 Tire inflation pressure is usually specified by the manufacturer as the pressure needed to sustain the rated 
load. Under-inflation is generally considered to be anything less than 95 per cent of required inflation. This poses some 
problems in that the conditions under which the pressure is measured (tire temperature, for one) plus the tolerances of 
the measuring device may exceed the inflation tolerances. Under-inflation leads to progressive and irreversible tire 
damage and possible failure at some future time. The evidence that the tire has been run under-inflated is seldom visible 
until the tire fails. The damage to the tire due to under-inflation did not necessarily occur on the flight on which the tire 
failed. 


Anti-skid and spin-up protection systems 
Anti-skid systems 


13.11.22 Maximum braking force on the aircraft is achieved at about 10 per cent wheel skid. If the wheel is locked 
(full skid) the braking force is significantly reduced because particles of rubber scraped off the tires act as rollers and 
lubricate the skid. Also, directional control is lost in a locked wheel skid and aircraft tires will probably not survive a skid 
of any duration. An anti-skid device, as designed, permits the pilot to apply full brake pedal pressure immediately after 
touchdown. The spin-up protection feature does not allow any pressure to the brakes until the wheels have spun up 
during touchdown. Then, detector units on each wheel will sense a skid condition and release brake pressure to that 
wheel until it spins up again. 
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13.11.23 Anti-skid systems usually have a low speed limit below which no anti-skid protection is afforded. This is 
done because the tires may be inadvertently entered into a braking/skid entry/pressure-release-then-reapplication 
sequence so rapidly that no effective braking is possible. At low speeds, the tire usually will withstand the braking action 
without overheating and is better off without anti-skid. 


13.11.24 In some aircraft, the system is rigged to release pressure in matched pairs of wheels on both landing gear 
to aid in directional control. Thus the system may be used as a device for consistently achieving maximum braking and 
stopping efficiency. 


13.11.25 Depending on the system and the aircraft, the cycling of the antiskid has been variously described as a 
“lurching” or an unexpected vibration in the landing gear and the sensation is sometimes one of reduced braking 
authority. This is probably because pushing harder on the brake pedals when the antiskid is cycling does not produce 
the expected increase in braking force. This has led some flight crews to suspect that the antiskid is not working properly 
and that it should be turned off. 


13.11.26 Antiskid systems can be turned on and off from the cockpit, and many of them incorporate a self-test fail- 
safe feature which automatically returns the system to manual braking with no protection. Some incorporate a light to 
indicate antiskid status. In others, switch position is the only indication. 


Spin-up protection 


13.11.27 Aircraft that are equipped with anti-skid systems normally are also equipped with a system that allows the 
aircraft wheel to accelerate to the aircraft speed completely after touchdown before allowing the anti-skid system to 
apply maximum braking effort. This also prevents the pilot from inadvertently applying brake pressure before landing 
which may result in blown tires. 


Combined systems in a bogey 


13.11.28 In a tandem gear bogey arrangement, the wheels may divide the spin-up protection and the anti-skid 
protection. That is, the forward wheels are more likely to hydroplane so they are equipped with the antiskid system 
sensor. The rear wheels are the first to contact the runway on landing and are equipped with the spin-up protection 
sensor. This enables the complete bogey to operate as an integrated system applying braking in the optimum manner. 


Hydroplaning 


13.11.29 All tires, regardless of tread design, will hydroplane on water (or any other fluid) when the dynamic 
pressure of the water is sufficiently high to lift the tire from the runway. Tread designs that create channels to divert 
water away from the tread may be effective in requiring deeper water to begin the hydroplaning action (partial 
hydroplaning) but the final dynamic hydroplaning will occur at an identifiable speed. Three types of hydroplaning are 
possible. 


Dynamic hydroplaning 


13.11.30 Dynamic hydroplaning is caused by the buildup of hydrodynamic pressure at the tire-pavement contact 
area. The pressure creates an upward force that effectively lifts the tire off the surface. When complete separation of the 
tire and pavement occurs, the condition is called total dynamic hydroplaning, and wheel rotation stops. When the tire is 
rolling freely at a fixed speed on a dry runway, the vertical ground reaction shifts forward of the axle and a spindown 
moment that offers resistance to the wheel rotation is developed. When these two moments are equal, the wheel is 
turning at a constant r/min. 
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a) The introduction of water on the runway leads to dynamic hydroplaning. Deep fluid on the runway 
creates additional drag on the tire when it is displaced from the tire path, and a high spray pattern is 
produced. As the forward speed of the aircraft is increased, the spray pattern thrown up by the tire 
lowers and the wedge of water penetrates the tire-ground contact area and produces a hydrodynamic 
lift force on the tire. This is partial hydroplaning. As the speed increases, the spray pattern becomes 
flatter, and the wedge of fluid penetrates farther into the ground contact area until at some high 
forward speed complete separation of the tire and runway takes place and total hydroplaning occurs. 
The ground friction is progressively reduced as the wedge of water penetrates beneath the tire. It 
approaches zero at total hydroplaning, and the spindown moment causes the tire to stop the wheel 
rotation. Obviously no braking action is available when the wheel is not making contact with the 
runway and has stopped rotating. 


b) Total dynamic hydroplaning is more of a landing than a takeoff problem; however, crosswind takeoffs 
are dangerous under these conditions. The approximate speed at which total dynamic hydroplaning 
occurs is: 


V, = 9VP 


Where:  V;, = hydroplaning speed (knots); and 
P = tire inflation pressure (Ib/in?) 


Total dynamic hydroplaning usually does not occur unless a severe rain shower is in progress. There 
must be a minimum water depth present on the runway to support the tire. The exact depth cannot be 
predicted since other factors, such as runway smoothness and tire tread, influence dynamic 
hydroplaning. Both smooth runway surface and smooth tread tires induce hydroplaning with lower 
water depths. While the exact depth of water required for hydroplaning has not been accurately 
determined, a conservative estimate for an “average” runway is that water depths in excess of 0.1 
inches may induce full hydroplaning. 


Further, one characteristic of hydroplaning is that even without braking action, the tire will eventually 
stop rotating. This negates all attempts to regain braking action until the aircraft slows. Because a non- 
rotating tire builds water wave-front pressure ahead and the lack of rotation does not funnel any water 
away, a total hydroplaning condition will continue until the speed has dropped to: 


V,=7.7VP 


If the water depth is sufficiently deep that the touchdown forces do not penetrate to the landing 
surface, no tire spin-up will be achieved and immediate hydroplaning may begin. Braking, therefore, 
will be delayed until the non-rotating tire speed is reached. 


Viscous hydroplaning 


13.11.31 Viscous hydroplaning is more common than dynamic hydroplaning. Viscous hydroplaning may occur at 
lower speeds and at lower water depths than dynamic hydroplaning. Viscous hydroplaning occurs when the pavement 
surface is lubricated by a thin film of water. The tire is unable to penetrate this film, and contact with the pavement is 
partially lost. Viscous hydroplaning often occurs on a smooth runway pavement or where rubber deposits are present, 
usually in the touchdown area where a thin water film can significantly reduce the coefficient of friction. 
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Reverted rubber hydroplaning 


13.11.32 The third type of hydroplaning is known as reverted rubber hydroplaning. This condition occurs when the 
heat that is generated during a locked-wheel skid turns water into steam and reverts the rubber to its natural state. This 
is called reverted rubber. White streaks on the runway are an indication that this type of hydroplaning has occurred due 
to the “steam cleaning”. Examination of the aircraft tire shows an elliptically shaped tacky or melted rubber condition. 


13.12 FUEL SYSTEMS 


General information 


13.12.1 The fuel system is essential for the operation of the aircraft. Any interruption of fuel flow can have 
catastrophic results because of the loss of power and the associated emergency situation. Accidents have occurred on 
multi-engine aircraft when the flight crew have been unable to cope with a single-engine fuel-related failure. 


13.12.2 Fuel system problems may occur very early in some mishap sequences although under different 
circumstances the event would barely be an incident. This is the aspect of mishap investigations which frequently 
requires a complete evaluation of the fuel system to disclose problems which provoked a set of events which lead to a 
mishap. 


Fuel types 
AVGAS 


13.12.3 Currently only aircraft utilizing reciprocating engines use AVGAS. Some problems on large aircraft may be 
due to the limited availability of the high-octane leaded 115/145 fuel required for large aircraft, such as the Douglas DC-6 
(Skymaster) and Lockheed Constellation (Connie) that were in wide use in the 1950s. The smaller aircraft engines have 
been reconfigured where possible to use the more available 80, 100, or 100 LL (low lead) octane AVGAS. Significant 
problems can occur when the aircraft are improperly serviced. Improper fuel can lead to premature ignition, detonation, 
and even complete engine failure. 


Kerosene fractions fuel (low volatility) Jet A, Jet A-1, JP-8 and JP-5 


13.12.4 a) Jet A-1 turbine fuel and JP-8 are essentially the same with JP-8 having additional additives. This fuel 
is widely used by commercial aircraft, especially outside the United States. It is kerosene fuel, and has 
a freezing point (-50° C) which is higher than JP-4 (-58° C), but lower than JP-5 (-46° C). 


b) JP-5. This kerosene fuel has a higher flash point (about 145° F) than JP-4. It does not meet the low 
temperature requirements nor does it have the additives which are found in JP-4. The fuel is slightly 
denser than JP-4. 


Kerosene blend fuels (high volatility) Jet B, JP-4 


13.12.5 Jet B is a wide-cut blend of kerosene and gasoline, and was chosen because it generally met the need for 
high energy output. Commercial Jet B turbine fuel is similar to JP-4, but does not normally contain additives. Additives 
for controlling or alleviating potential problems, such as fuel system icing, corrosion, or static electricity, are incorporated 
in the military specification (MIL-T-5624L). This specification should be consulted for the current requirements. 
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Other fuels 


13.12.6 Investigators should keep in mind that military aircraft sometimes use specialized fuels based on their 
specific operating situations and environment. Therefore, if a fuel is suspected to be a factor in an accident or an 
incident and the fuel specifications do not comply with civil fuel specifications then perhaps a military fuel was involved. 


Fuel sources 


13.12.7 Fuel samples should be obtained from the refuelling vehicle or source of the last servicing in order to 
determine if the fuel was of the correct quality and type. 


Fuel electrical characteristics 


13.12.8 Fuels have electrical characteristics that may be important to mishap investigators. Under high fuel flow 
conditions it is possible to create an electrostatic charge that may have sufficient energy to be an ignition source. Also 
the dielectric properties of the fuel affect the operation of the fuel gauging system. 


Dielectric constant 


13.12.9 The dielectric constant of the fuel decreases in a linear fashion with increasing temperature. This requires 
fuel gauging systems to be calibrated for the particular fuel being used. 


Electrical conductivity 


13.12.10 Basic turbine fuels are essentially nonconductors of electricity. Trace amounts of impurities increase the 
fuel conductivity; however, it still remains very low. 


13.12.11 This property can cause a very hazardous situation in the handling and transfer of fuels. Flowing fuel tends 
to become electrically charged due to a shearing mechanism called “charge separation.” This can result in developing 
high levels of electrostatic charges within the fuel which cannot be dissipated due to the low conductivity of the fuel. 
These fuel charges can build up to levels which are high enough to cause a static discharge through vapours in tanks. If 
the conditions are favourable, ignition may occur. 


13.12.12 The causes and results of static electric buildup are complex and varied. Some of the factors are the 
contact areas in the filter separators, relaxation time required for the charge to dissipate, protruding devices in the flow 
channels, impurity levels in the fuel, and fuel system design. A root part of the problem is the fundamentally low 
conductivity of fuels. The conductivity level of a fuel should be evaluated by a laboratory when the mishap involves fuel 
tank fires. 


Aircraft fuel systems and components 
Fuel storage and feed 
13.12.13 The fuel tanks of modern aircraft are of three principal types: welded aluminium; wet-wing or integral; and 
fuel bladders. The aircraft design criteria requires a second fuel barrier if a fuel leak could migrate to the engine or crew 
areas. Any leakage must drain overboard. 


a) Welded aluminium tanks are self-contained sitting within a cradle-and-strap supporting structure. 


b) The integral or wet-wing fuel tank is a metal or composite construction with seams sealed with fuel- 
resistant sealing compound. 
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c) Bladder tanks are made of tear-resistant materials, usually made of rubber-coated nylon and nitrile 
rubber. They are usually located within an abrasion-resistant bay and are shaped to fit the specific fuel 
cavity. The bladders are primarily held in place by clips, Velcro and snaps. Some bladder tanks have 
been found to have a diagonal wrinkle in the bladder after installation that prevented full water flow to 
the quick-drain. 


13.12.14 The typical fuel feed system consists of two independent subsystems, with the left wing and left main tank 
feeding the left engine, and the right wing and right main tank feeding the right engine. The left and right systems can be 
interconnected by opening crossfeed valves to allow fuel to be pumped to both engines and the APU from either side. In 
addition, the two main tanks can be interconnected by opening a tank gate valve to permit equalization of the fuel in both 
tanks by gravity. In addition, any auxiliary power unit (APU) will draw from one or both primary tanks. 


13.12.15 Boost pressure is provided by AC boost pumps located in each main and wing tank. A DC boost pump, 
located in the left main tank and powered by the DC essential bus, is used during engine and APU starts if the left main 
boost pump is inoperative. 


Fuel caps 


13.12.16 Fuel caps are designed to allow maximum filling of each tank and prevent water or other contaminants 
from entering the tank. Many aircraft have been equipped with low-drag, flush-set filler caps. When the sealing gaskets 
deteriorate or the metal flange becomes corroded in the seal area, water can enter the tanks. In general aviation, aircraft 
where drag is not a large penalty have full-covered caps that protrude above the wing surface routing water below the 
fuel tank opening. 


Aircraft refueling system 


13.12.17 The aircraft refueling system is either through individual fuel caps or a manifold system designed to fuel all 
tanks from a single point. 


13.12.18 Fuel caps are normally designed to lock into place with a folding tab that lies along the slipstream which 
prevents the tab from opening due to wind blast. A cap left unsecured or one that becomes so through the tab lifting will 
most probably vent the fuel overboard. Fuel caps are frequently in areas where they are not visible by the crew who 
therefore will be unaware of the venting. Aircraft using over-the-wing refuelling of individual fuel tanks through these 
caps may have a specific order of filling in order to not have a fuel spill result from a lower tank being opened after fuel 
has migrated to the tank. Also a critical fuselage angle for refuelling the aircraft may be required so as to make the entire 
tank available for fuel. The Cessna 210 model has been known to have the fuel servicing leave the aircraft critically short 
of fuel when the pilot and refuelling personnel did not ensure the aircraft was level prior to refuelling. 


13.12.19 Single-point refuelling systems are used extensively in commercial transport and military aircraft. In these 
systems either the fuel transfer system or a separate manifold system is designed to feed fuel into all available tanks. 
The refuelling hose is connected to the aircraft system through a poppet-valve which ensures no fuel is lost from the 
system when the hose is disconnected. The pressure of fuel provided is critical to the success of this type of refuelling 
as is the function of the vent system. A leak in the manifold type system may result in an accumulation of fuel in an area 
where it represents a significant hazard. 
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Fuel jettison system 


13.12.20 Large aircraft often have a system installed to jettison (dump) fuel to lower the gross weight of the aircraft 
facilitating an emergency landing. These systems are designed with two major criteria in mind: the amount of fuel 
remaining after the jettison will still allow a normal approach and landing (although at or near maximum certificated 
landing weight), and no adverse handling characteristics will result as a function of the lost fuel. To accomplish this, the 
systems are restricted to jettisoning fuel only from specific tanks and, if there is more than one major tank array, a 
specific order of fuel jettison is dictated. 


13.12.21 The jettison system operates either from a separate set of pumps or additional air pressure applied to the 
tank(s). Fuel is then routed to a mast in the wings or tail and overboard into the slipstream. 


Vents 


13.12.22 The vent system has two functions: equalize the pressure between the inside and outside of each fuel tank 
— in all flight attitudes, at all elevations and in all weather conditions — and it must prevent fuel from flowing out of the 
tank when the aircraft is refuelled or parked on uneven ground. 


13.12.23 Any blockage of the vent pipes or valves may cause an unacceptable pressure differential to build up 
across the tank wall. Since the tank wall is usually primary structure, the resulting failure is likely to be catastrophic 
though lesser damage, if undetected, can subsequently be a contributory factor. 


13.12.24 A common malfunction in the vent system is an accumulation of ice from precipitation prior to flight or icing 
build-up in-flight. A common location for the vent is behind the upper end of the lift strut on high-wing general aviation 
aircraft. These vents are simple aluminium tubes dropping out of the lower wing surface and turning 90° to point forward. 
The location of this type of vent is critical. If it is not placed correctly, the possibility of vent icing increases and the tank 
may be over-pressurized by ram air. For example, the vent tube of a Cessna 185 has a very small tolerance for location: 
+0.03 inch. 


13.12.25 The other function of the vent is solved by the use of a check-valve. As fuel heats up while the aircraft is 
parked it expands. The tank may fail if the venting of pressure is not allowed. Yet the fuel must not be allowed to flow 
freely from the vent. In some aircraft, check valves have a small hole in them to allow air equalization and a small 
amount of fuel seepage. 


13.12.26 Certain failures or blockages may cause fuel to be lost overboard leading to further problems such as 
additional fire hazard, fuel imbalance, or loss of range. 
Tubing 


13.12.27 The fuel tubing is lightweight and extremely reliable. A variety of materials are used, but the most common 
is aluminium alloy. 


13.12.28 The proper installation and maintenance of fuel lines and fittings is particularly important because of the 
flammability of fuel. A small fuel leak in a confined area of an aircraft can produce an explosive atmosphere which can 
be easily ignited. 


13.12.29 Fuel lines are routed and supported in such a manner that they will not be damaged by vibration, abrasion, 
or chafing. 
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13.12.30 Fuel lines are kept separate from electrical wiring. In cases where separation is not possible, such as in 
bulkhead openings, the fuel lines and electrical wiring may be routed together. Here, the fuel lines are located below the 
electrical wiring and clamped securely to the aircraft structure. The electrical wiring should not be supported by the fuel 
line, but must be separately attached to the airframe structure. 


Hoses 


13.12.31 Hoses are used to connect plumbing where movement is expected, to isolate components from aircraft 
vibrations or in-flight structural changes. A typical hose is made of a synthetic rubber, reinforced with fiber braid 
embedded in a bonding material. Hoses used in high-temperature areas have an additional wire braid outside cover and 
typically have working temperatures of -40 to +300° F. Some hoses are time-change items, whereas others are only 
changed when they fail or are damaged. 


Filters 


13.12.32 The fuel system usually contains provisions for filtration at three or more points in the system before 
delivery to the engine. The fuel is further filtered within the engine fuel system to avoid contamination of the low- 
tolerance engine fuel system components. 


13.12.33 The feed tank boost-pump has a coarse mesh strainer. This removes the large contaminants. Some 
contaminants may remain in the fuel tanks after manufacture or maintenance, while other items may be introduced 
during over-the-wing refuelling. 


13.12.34 Main fuel system filters are usually located near the engine accessories at the lowest point in the fuel 
system. These filters have a bypass warning indicator which is checked by maintenance personnel at frequent intervals. 
The bypass feature permits continued short-term operations, but places a greater cleaning burden on the downstream 
filters. 


13.12.35 There are filters within the engine fuel system and the fuel control. These are very small filters and are 
used to trap the smallest of contaminants. If blocked with contamination, these filters can cut off fuel flow to the engine 
or can cause the engine fuel control to incorrectly schedule fuel flow. 


Connectors and clamps 


13.12.36 Two types of connectors and clamps are used in the fuel systems. Permanent fittings are located 
throughout the system to connect tubing and flexible hoses. Quick-disconnect fittings are used in the engine area and for 
auxiliary fuel tanks. 


13.12.37 The engine quick-disconnect fittings are very reliable and when correctly installed do not usually pose any 
problems. The engine installation maintenance checks serve to ensure they are properly installed. It is very rare to find 
problems in this area. Most are safety-wired in the locked position. 


Sumps and drains 


13.12.38 Fuel tanks are equipped with sumps and drains to trap accumulated water before it enters the aircraft fuel 
system. Water-contaminated fuel system mishaps occur occasionally in small reciprocating engine aircraft, but are 
relatively unknown in larger turbine engine aircraft. This is because the turbine engines are more tolerant of water, 
turbine fuel additives, and the general use of single point refuelling. Water contamination should not be overlooked, but it 
is usually not a prime suspect for turbine engine aircraft. 
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Pumps and valves 
13.12.39 Pumps and valves are used to control fuel flow to the engines and to transfer fuel between tanks. 


13.12.40 The vast majority of systems use AC electrical boost pumps which are located throughout the system to 
either transfer fuel between tanks or to provide positive pressure to the engine-driven fuel pump. Typically, there are 
independent boost pumps for each engine. 


13.12.41 Fuel may be transferred from wing tanks and auxiliary tanks using bleed air pressure from the engine. A 
pressure vent valve is located in each tank and is normally in the open or vent position. For fuel transfer, the valve is 
closed to pressurize the tank to a nominal pressure of 10 Ibs/in? with a maximum of 16 Ibs/in? in most cases. The 
pressure is maintained by a pressure regulator. Check valves are installed in the air lines to prevent reverse fuel flow. 
Shutoff valves in the main tank stop the fuel flow when the main tank is filled to the prescribed level or to stop the flow of 
fuel into or out of the tank on demand. 


13.12.42 Fuel may be transferred using ejector pumps. In these systems a dual element boost pump is used. In 
addition to supplying fuel to the engine, an appropriate amount of fuel is provided to jet (ejector) pumps that 
automatically transfer fuel within the system. 


13.12.43 Fuel may also be transferred using a single pump for more than one tank. These proportional pumps 
depend on steady flight conditions to operate effectively. Out-of-balance conditions can be expected when the flight 
involves a lot of manoeuvring. This can lead to fuel imbalances and possibly trapped fuel. 


13.12.44 Hydraulic-driven fuel transfer or boost may be used to provide fuel under high-demand conditions, such as 
afterburner operations. Also, in some aircraft, hydraulic-driven fuel transfer pumps are used to provide high transfer 
rates which are needed to maintain the correct center of gravity. Serious control problems can result when the transfer 
system fails and an adverse center of gravity condition occurs. 


13.12.45 Motor-driven, DC electrically powered valves are used throughout the system. The valves are powered to 
either the open or closed position. Electrical circuits are provided to eliminate the possibility of uncommanded 
movements. The valves are equipped with position indications to indicate the position of the valve; however, if the shaft 
fails the indicator may be in error. 


Selectors, electrical switches and indicators 


13.12.46 Unless the aircraft has a single fuel tank which feeds directly to each engine, there will be a method for the 
crew to select which tank(s) is in use. Selectors may electrically activate a valve elsewhere in the system, or a physical 
valve which is moved by crew action. 


13.12.47 The valves and other control devices controlled by DC electrical power is usually from one of the primary 
essential DC electrical busses. The switches are generally conveniently located in one area in the cockpit. This assists 
in correct fuel management. 


13.12.48 The primary firewall engine fuel shutoff valves may be located separately and receive DC electrical power 
from one of the emergency or battery busses. On some aircraft the main fuel shutoff valves are operated (closed) when 
the throttles are placed in the cutoff position as well as by the emergency shutoff “T” handle activation. 


13.12.49 The fuel quantity indicating system provides information on the amount of fuel available in the primary feed 
tank or tanks as well as total fuel for selected tanks. Capacitance-type tank units provide information on the quantity of 
fuel available. The indicator systems are generally powered by AC electrical power. 
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13.12.50 Pressure switches are also located within the system plumbing. These switches may activate warning 
lights to indicate to the aircrew that there is loss of fuel pressure. Also, various mechanical fuel shutoff valves are used 
to stop the flow of fuel between tanks during fuel transfer operations. 


13.12.51 The aircraft maintenance technical orders should be consulted for detailed information on the specific 
aircraft. 


Engine fuel system 


13.12.52 The primary function of the engine fuel system is to supply the engine with the correct quantity and 
distribution of fuel to meet operating demands. Secondary functions may include maintaining servo pressures for 
selected engine accessories, providing a bypass for excess fuel, providing scheduling and positioning of variable stators, 
and providing a positive shutoff of engine fuel. The main components of the engine fuel system are: main fuel filters, 
main fuel pump, fuel control, pressurizing and drain valve, afterburner fuel pump, engine fuel nozzles, and afterburner 
fuel nozzles. 


Fuel filter 


13.12.53 The fuel filter may be part of the main fuel pump, or it can be a separate element. The fuel screen size 
varies with aircraft, but can be as low as 40 microns. The filter has a bypass element to permit fuel flow if the filter is 
blocked. 


Main fuel pump 


13.12.54 The main fuel pump is generally mounted on an accessory drive gear box. The pump may consist of a 
boost element, a fuel screen, a high-pressure element, and a pressure-relief valve. The boost element can have either 
one or two elements, which can be either a positive displacement gear-type or a centrifugal impeller-type. Typically, the 
boost element is of centrifugal design and the pressure element is of gear-type design. 


13.12.55 The failure of the main fuel pump's pressure element causes an immediate flameout of the engine. Failure 
of the boost element can cause cavitation and failure of the pressure element. Usually, failure of the boost element 
causes engine surges or flameout above a predetermined altitude depending on the engine. 


Main fuel control 


13.12.56 The typical main fuel control has fuel metering and computing sections. The metering section selects the 
rate of fuel flow to the fuel nozzles. Selection is based on the information received from the computing section. Engine 
operating parameters are integrated in the computing section to provide proper fuel flow, control of variable geometry, 
and provide limited protection for the great variety of conditions that can be experienced by the engine throughout its 
operating envelope. 


13.12.57 Earlier turbine engines used hydro-mechanical fuel controls, whereas new model engines use electronic 
fuel controls. In all cases a fuel control must have at least one main fuel valve and its actuating mechanism. The 
complexity of the investigation is enhanced with the more complex fuel controls. 


13.12.58 Any abnormal operation of the fuel control results in erratic engine operation or, in extreme cases, 
complete engine failure. 
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Pressurization and drain valve 


13.12.59 The pressurizing and drain valve performs three functions during engine operation: (1) it maintains a 
minimum fuel pressure for the operation of the main fuel control servo; (2) it provides proper fuel pressure to the nozzles 
throughout the range of engine operation; and (3) it drains the fuel manifolds during engine shutdown. The valve 
contains a piston-type valve which opposes the main fuel discharge with the combined force of a calibrated spring and 
main fuel reference pressure. 


Main fuel nozzles 


13.12.60 The main fuel nozzles are mounted in the compressor rear frame or on the combustor case. The number 
varies by engine type. To protect the flow orifices and flow dividers from possible contamination, a filter screen can be 
located at the fuel inlet in the cap portion of each nozzle. Air is used to cool the tip to reduce carbon deposits and tip 
cracking and to position the burner flame. 


Fuel system investigations 
Fuel quantity and availability 


13.12.61 A major consideration in many fuel-related mishaps deals with determining the quantity and location of the 
fuel within the aircraft. 


13.12.62 The fire pattern in a partially destroyed aircraft mishap may provide the first clue. A fire located in the right 
wing area with none on the left wing and very little in the fuselage area points to trapped fuel in the right wing, etc. 


13.12.63 Fuel tank selectors, especially manual valves, should be examined carefully to ensure the valve is open to 
a tank that had fuel available. Several accidents have occurred when the crew member selected an incorrect or 
intermediate valve position thus cutting off fuel from one or all engines. Valve visibility, by-touch identification, and 
difficult activation motions have all been contributing factors. 


13.12.64 An analysis of the feed tank fuel gauge(s) may provide important information. The instrument analysis 
section should be consulted for general information. The information must be correlated with other information. 


13.12.65 The analysis of the low-level and low-pressure light bulbs may provide supporting information. The low- 
level light indication reliability is enhanced when the light has a separate mechanical fuel level transmitter. In some 
aircraft, low-level light illumination is based on the fuel quantity transmitter. In this case a faulty fuel transmitter can 
negate this emergency fuel state notification. 


13.12.66 The refuelling records may help determine quantity of fuel available. Several incidents have occurred 
because of confusion in fuel quantities due to units of measurement, i.e. gallons, litres, pounds. A detailed estimate of 
last known fuel quantity minus estimated fuel consumption can result in a fair estimate of the fuel available at the time of 
mishap. 


13.12.67 The total readings on any gauges may be misleading to both the aircrew and the investigator. This is 
because trapped fuel is frequently a factor in mishaps involving complete engine failure due to lack of fuel at the engines. 
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Fuel type 


13.12.68 The servicing of reciprocating engine aircraft with jet fuel has caused many mishaps. Improper servicing 
should be a prime suspect in a complete power loss reciprocating engine mishap. Similarly, turbo-charged reciprocating 
engines may have “turbo” as part of their name, but use AVGAS, and may result in improper turbine jet fuel servicing. 
Although there are many adverse consequences associated with servicing jet aircraft with AVGAS they are usually not 
catastrophic. Most turbine engines tolerate many fuels for a short period of time. The wrong type of fuel can significantly 
affect aircraft performance, especially range. 


13.12.69 Fuel samples should be taken when the fuel system may be a factor in the mishap. If a complete analysis 
is required, at least one litre of fuel from each tank is needed. The results can provide information on the type of fuel and 
the presence of any contaminants which could have contributed to the mishap. Samples should be collected in clean 
containers and drawn from a fuel tank sump or a fuel line to the engine. The investigator’s field kit should include 
containers for samples. Samples should be taken to a qualified laboratory for analysis. 


Transfer systems 


13.12.70 In many aircraft fuel is transferred to a feed tank and then to the engines. The feed tank is considered to be 
the last tank before the direct feed to the engines. In transport aircraft the fuel tanks are associated with individual 
engines and have transfer or manifold systems to crossfeed fuel between engines or tanks. The positioning of the 
control valves must be carefully documented, since they provide valuable information on pre-accident situations. 


13.12.71 The primary boost pumps in the main fuel tanks can provide valuable information as to their status at the 
time of the mishap. Operating pumps generally exhibit signs of rotational damage. This damage is a primary indication of 
electrical power. At low altitude and low-power settings boost pump operation is not generally essential for flight, so the 
failure of a boost pump should not generally lead to a mishap. 


13.12.72 Some aircraft have fuel transfer systems which automatically attempt to fill the feed tanks whenever a low 
fuel level situation exists due to aircrew tank selection or inaction. These systems are designed to override flight crew 
actions to prevent depletion of fuel in the feed tank. The recovery of transfer valves in the open position when they 
should be closed indicates the auto transfer system may have been activated. This may indicate trapped fuel or fuel in 
tanks other than the feed tanks. 


13.12.73 The main fuel shutoff valves provide a primary point of failure when abrupt engine failure occurs. The 
design should prevent unanticipated operation of these valves due to stray voltage. 


a) The specification requires power to remain to the valve based on the last commanded movement. The 
movement of the valve also interrupts various parts of the circuit to prevent uncommanded operations. 


b) In spite of this design there have been occasionally main fuel shutoff valve-related mishaps. A careful 
analysis of the valve and electrical circuits should be undertaken when main fuel shutoff valve 
problems are suspected. 


c) The fuel lines should be checked for integrity, leaks, fractures, fire and explosion. The fuel lines in the 
engine bay areas should show some evidence of damage (tearing or stretching) when the engines are 
displaced from their normal position or detached from the aircraft. The lack of damage may indicate a 
loss of fuel line integrity before the mishap. 
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d) The fuel filters should be checked for contamination and bypass status. The bypass indicator is not 
usually a reliable indicator of pre-impact bypass condition when there are significant mishap forces 
involved. The prolonged operation in a bypass condition can result in contaminated fuel control and 
complete or partial power loss. Fully contaminated, non-bypass filters can cause unscheduled engine 
operation. 


e) The cockpit switch settings can provide an indication of their position before the mishap. Care should 
be exercised in using this information; switches, even guarded or safety-wired switches, can move 
during the mishap sequence. Also, the first people on the mishap scene may move some of the 
switches. This is particularly true when crash response personnel have entered the cockpit area to 
rescue an aircrew-member or to shut down operating equipment. 


Fuel tank and line failures 


13.12.74 Fuel tank failure is relatively rare in mishap causes, but should be suspect when there is a massive fire. 
For example, on an aircraft several years ago the sheet metal covering on the fuel cells was “oil canning” due to 
changing pressures. The sheet metal subsequently failed, and the jagged metal punctured the bladder tank. A massive 
fire ensued in the tank area. The evidence was burned, but an evaluation of several other aircraft revealed the problem. 


13.12.75 Bladders fail because the tank materials dry out allowing the tank bladder to become brittle. Examine the 
aft inboard corner of the tank bay for a gummy residue caused by leaking fuel that has washed the adhesive off the tape 
applied to the bladder to prevent chafing. 


13.12.76 Vent system failures may cause catastrophic failure of a fuel tank and result in a significant hazard 
depending on the location of the tank and the ability of the aircraft to land without the lost fuel. 


13.12.77 Chafing is a major problem for aircraft fuel lines. There must be a match between the expansion of the 
aircraft in various flight regimes and the routing of the fuel lines. This applies to connectors as well. The manufacturers 
have introduced new techniques and connectors to deal with the problem, but this should be a suspect area when an 
explosion or fire of an unknown origin is involved. 


13.13 AIRBORNE COLLISION AVOIDANCE 


13.13.1 The Airborne Collision Avoidance System (ACAS) also called Traffic Alert and Collision Avoidance System 
(TCAS) is required on many commercial aircraft. The system is designed to make flight crews aware of nearby traffic 
and to resolve conflicts. ACAS uses existing Air Traffic Control systems and the capabilities of Mode-S transponders to 
coordinate evasive manoeuvres between conflicting aircraft. Components of ACAS typically include a transponder, 
several antennas and a computer. Manufacturer’s assistance is required to test components or recover non-volatile 
memory. 


13.13.2 ACAS technology is being developed which would transfer control of an aircraft sensing an imminent 
collision to the flight computer, manoeuvre the aircraft away from the potential collision, then transfer control back to the 
autopilot/crew. At least one occurrence is known where this system applied an evasive manoeuvre to an aircraft only to 
put it into a potential collision with another. 


13.13.3 One difficulty addressed by recent investigations is the conflict between air traffic controllers and an ACAS 
advisory. A mid-air collision resulted from a crew choosing to follow controller instructions instead of an ACAS alert, not 
knowing that the controller was not able to receive the same alert. 
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13.13.4 Another air-ground traffic control and alerting system which has recently shown advances is the Automated 
Dependent Surveillance Broadcast (ADS-B). This utilizes a combination of aircraft transmitters and ground relay stations 
to provide both air-to-air warnings and also position for ground controllers to provide sequencing and separation similar 
to radar control. 


13.14 ENHANCED GROUND PROXIMITY WARNING SYSTEM (EGPWS) 


13.14.1 Ground Proximity Warning System (GPWS) Terrain Awareness are required on aircraft carrying 30 or 
more passengers. The system alerts the pilots of impending hazardous proximity to the ground through aural and visual 
warnings. In addition, certain systems may also be integrated with the windshear warning system to alert the crew of the 
presence of dangerous windshear on take-off or landing. The original system was designated a Ground Proximity 
Warning System (GPWS) and has evolved into an Enhanced Ground Proximity Warning System (EGPWS). The 
systems rely on inputs from many other aircraft systems such as the GPS, radio altimeter, air data computer, and stall 
warning computer. If questions about the performance of a terrain warning system arise, it may be necessary to 
investigate the performance of these interfacing systems. Accurate topographic data may be necessary to fully evaluate 
system performance. Also, the predictive computers typically contain non-volatile memory which may be extracted to aid 
in the investigation of a ground collision. 


13.14.2 Investigators should be aware that since terrain warning systems involve a predictive computer analysis, 
some terrain features may trigger a warning when sensing rapidly rising terrain lying beneath approach paths. In this 
case, investigate whether a terrain warning is “normal” on the suspect accident approach, thus negating any reaction by 
the crew to a true warning to the accident aircraft. 


13.15 NON-VOLATILE MEMORY SYSTEMS 


General 


13.15.1 Modern aircraft are equipped with many computer-based electrical systems. In order for these systems to 
be ready for use at initial power-up, they retain readings from previous settings or internal calculations. Limitations are 
preset and compared to values during operation. These “recordings” are retained after power down (or loss) in special 
integrated circuit memory chips known as non-volatile memory. Flight data recorders utilize non-volatile memory circuits 
and are likely to retain data due to the “hardening” of the recorder system. (See Chapter 7 for discussion on Flight Data 
Recorders and additional discussion on non-volatile memory data.) While not crash-hardened, many other circuit boards 
and the integrated memory chips may survive with data held within. Investigators should be aware of the systems on the 
aircraft that have non-volatile memory and seek them out. Like flight data recorders, they may hold unique details of the 
system or the aircraft's operation prior to power loss or impact. 


Typical non-volatile memory systems 


13.15.2 It would be impossible to detail each system on a modern transport aircraft that may contain non-volatile 
memory. Suffice it to say that the more electronic and computer driven a system becomes, the more likely it will have 
some non-volatile memory. Similarly, the data contained within is not in a uniform format and the system manufacturers 
will likely have to become involved for the data recovery to be useful to investigators. Aircraft and engine manufacturers 
may leave the selection of systems up to the customer, so not all aircraft of a specific type will have the same systems 
and, therefore, not the same set of non-volatile memory available. Table III-13-4 demonstrates what a “typical” modern 
aircraft may contain. 
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Table Ill-13-4. “Typical” Boeing 757 systems containing non-volatile memory 





Digital Flight Data Acquisition Unit DME Receiver 

EICAS Computer Generator Control Unit 

Inertial Reference Unit Bus Power Control Unit 

Air Data Computer Yaw Damper Computer 

Ground Proximity Warning Computer Air Supply Control/Test Unit 

Electronic Flight Instrument Symbol Generator Zone Temperature Controller 

ADF Receiver Auxiliary Zone Temperature Controller 

Radio Altimeter Pack Temperature Controller 

VOR/MB Receiver Pack Standby Controller 

TCAS Unit Cabin Pressure Control Unit 

ILS Receiver Proximity Switch Electronics Unit 

Weather Radar Transceiver Brake System Control Unit 

ATC Transponder Tire Pressure Monitor Unit 

Airplane Communications Addressing and Fuel Quantity Indication System 

Reporting (ACARS) Unit Electronic Engine Control 
Engine Vibration Module 
Courtesy The Boeing Company 














Protection of non-volatile memory 


13.15.3 While electronic systems containing non-volatile memory are not always designed to survive crash impact 
forces, other design issues contribute to the likelihood of retained memory. The small size of the modern integrated 
circuit contributes to its survivability. The installation of the circuit on a larger circuit board allows some damage to be 
absorbed without affecting the non-volatile memory. 


13.15.4 In some cases, designers have afforded the integrated circuit more “survivability” by incorporating 
safeguards against memory loss during use and extremes of normal operations. The most common example of this is 
the protection of the circuit chips from operating heat by placing heat-sinks in close proximity. The heat-sink, while not 
designed to protect the circuit chip from impact damage, does so anyway. In some cases, these heat sinks are mere 
sheets of metal overlaying the circuit chips. These are commonly called “carports” and may absorb sufficient impact 
forces and heat to allow the non-volatile memory circuit to be extracted, placed in a test-board or a serviceable unit and 
the resident data extracted. (See Figure III-13-10.) 


Safeguarding non-volatile memory 


13.15.5 Investigators, aware of the presence of electronically stored data in non-volatile memory circuits, should be 
prepared to identify, handle, recover and transport the specific circuits in whatever condition the system is discovered. In 
the best case, the system itself may have survived the impact forces and post accident environment. In this case, the 
entire system should be recovered and disassembled by manufacturer’s investigative experts. This is the best protection 
possible. In the cases where damage is extensive, the circuit board may be separated from the system case. In these 
cases specialized handling may be required. 


a) Do Not Apply Power. Where non-volatile memory may be present, this data should be extracted 
before any power is applied to the system during investigation. Once power is applied, initialization 
may take place and data present at the loss of power during the accident sequence may be lost. 
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b) 


c) 








“Carport” Heat-Sink 








Figure Ill-13-10. Circuit board with non-volatile memory protected 
under a “carport” heat-sink 


Of special note to investigators, any circuit board suspected of having non-volatile memory found 
separated from its normal installation case should be handled with extreme care. Static electricity may 
build up through clothing or by winds at the accident site. Touching the circuit board may release the 
static electric charge into the circuit. Wearing leather work gloves does not protect against the transfer 
of static electricity. If a circuit board is discovered, investigators should examine the card for a corner 
that is intentionally designed free of circuits enabling assembly personnel to handle the board. This 
corner should be the only part of the circuit card to be touched. When in doubt, the card should be 
recovered by a system expert. 


If immersed in water, do not allow exposure to air. Circuit boards and integrated circuits are very 
susceptible to corrosion. While exposure to fresh water or sea water may have corrosive effects, 
exposure to air after immersion will have a greater effect. If at all possible, manufacturers should be 
consulted as to whether to transfer components from sea water to fresh water or whether to leave all 
components immersed in the sea water. Some manufacturers prefer leaving components immersed in 
the same water as found as the mere transfer from one environment to another may start or 
accelerate the corrosive cycle. If consultation is not feasible, it is suggested that investigators leave all 
components in the same water as found and transport them to an examination facility as soon as 
possible for data recovery. 


Store in “static-safe” plastic bags. If non-volatile memory circuits are recovered apart from their system 
case, from on-land environments, they should be placed and transported in static-safe plastic bags. 
These bags are normally available from computer supply stores and should be obtained in sufficient 
quantity and size for the components expected to be found. Once in the bag, the components are 
protected from inadvertent exposure to static electricity. 
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d) Do not disassemble components with non-volatile memory. All handling of non-volatile memory and 
the system components containing the NVM should be handled as little as possible to protect from 
inadvertent memory alteration. 


i) If the circuit board is found within the system case, wires should be cut upstream of the system so 
that the handling of connectors can be avoided. Individual wires should be cut instead of all wires 
simultaneously, if possible. 


ii) If connectors or cannon plugs are exposed, avoid handling them as handling may bridge a 
connection allowing discharge or static electricity to alter the memory contained. 


Damaged non-volatile memory 


13.15.6 Should the non-volatile memory circuits be discovered damaged by impact or post-impact environment, 
reasonable care should still be exercised. In special cases where data cannot be found otherwise, it may be possible for 
specialized laboratories to extract data from damaged chips. While time-consuming and expensive, recovery of some 
data may be possible using micro-electronic techniques if investigators have taken the precautions listed above. 


13.16 ROCKET-DEPLOYED EMERGENCY PARACHUTE SYSTEM 


13.16.1 Some light aircraft are fitted with a rocket-deployed emergency parachute system. These parachute 
systems are designed to safely bring the aircraft and its passengers to the ground should a serious in-flight emergency 
arise. (See Figure Ill-13-11.) 


13.16.2 Composite structured aircraft such as the Cirrus Design SR20 and SR22, Pipistrel Virus and Sinus and the 
Sting TL-2000 are fitted with the system at manufacture. Others, such as the Cessna 150/152, 172 and 182 series 
aircraft can be retro-fitted with these rocket-assisted recovery parachute systems. 





Figure Ill-13-11. Rocket-deployed emergency parachute system 
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13.16.3 Numerous sport aviation and ultra-light aircraft in Australia are also fitted with rocket-assisted recovery 
parachute systems. Estimates from Recreational Aircraft Australia (RAA) indicate that there are currently at least six 
different types of ultra-light aircraft on the RAA register that are fitted with rocket-assisted recovery parachute systems. 
The exact number of sport aviation and ultra-light aircraft with these installations was not determined. 


13.16.4 An armed and undeployed rocket-deployed emergency parachute system presents a potentially serious 
safety risk to personnel attending the site of an accident. There is also inconsistent identification and marking of the 
hazards posed by the rocket and the associated equipment on the external surfaces of the aircraft. Any failure to 
correctly identify the hazard posed by the rocket at an accident site could result in serious injury or death. 


Cirrus airframe parachute system (CAPS) 


13.16.5 The Cirrus Design SR20 and SR22 aircraft are fitted with the Cirrus Airframe Parachute System (CAPS) 
ballistic recovery parachute system at manufacture. The CAPS system is manufactured by Ballistic Recovery Systems 
Inc. (BRS) in the United States. When deployed in an emergency situation, the system is intended to bring the aircraft 
and its occupants safely to the ground. 


13.16.6 The system consists of a composite enclosure containing the parachute and a solid-propellant rocket for 
parachute deployment, a CAPS Activation T-handle that is positioned in the ceiling liner of the cockpit and a parachute 
harness. 


13.16.7 The composite enclosure containing the parachute and rocket assembly is positioned in the aircraft 
immediately behind the cabin baggage compartment bulkhead. The parachute on the Cirrus is enclosed within a 
‘deployment bag’ inside the box. The deployment bag stages the parachute’s deployment and inflation. A thin composite 
cover that is faired into the aft upper fuselage structure protects the parachute assembly. 


13.16.8 The parachute is attached to the aircraft by three harness straps. The single rear harness strap supports 
the rear of the aircraft and is attached to the structure of the rear baggage compartment bulkhead. The two forward 
harness straps are attached to the engine firewall area and support the front of the aircraft following parachute 
deployment. Both of the front straps are concealed in channels beneath a thin composite fuselage outer skin and pass 
from the rear baggage compartment below the cabin windows and door frame. 


13.16.9 The CAPS Activation T-handle is positioned in a recess in the cabin ceiling lining above the front seats. 
The T-handle is concealed by a placard cover that must be removed before the handle can be pulled for CAPS 
operation (see Figure Ill-13-12). 


13.16.10 The CAPS handle is made ‘safe’ by the insertion of a safety pin into the Activation T-handle mechanism. 
The safety pin is normally removed during the pre-flight inspection of the cabin area. The pin has a ‘remove before flight’ 
tag attached. 


13.16.11 To operate the CAPS system in an emergency, the pilot removes the placarded cover and pulls down on 
the CAPS Activation T-handle. A pull force of about 35 Ib is required to activate the system. During the deployment 
sequence, the rocket forces the parachute canister up through the concealed composite fuselage cover. As the 
parachute inflates, the two forward attachment harnesses are pulled through their composite covering beneath the 
fuselage skin. 
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Figure Ill-13-12. Roof mounted CAPS activation handle cover 


13.16.12 A warning in the Cirrus’s maintenance manual indicates’: 


a) The rocket exits the fuselage with a velocity of 150 mph in the first tenth of a second and reaches full 
extension in less than one second. People near the airplane may be injured and extensive damage to 
the airplane will occur. 


b) Rocket ignition will occur at temperatures above 500°F (260°C). 


Cessna aircraft 


13.16.13 The Cessna 150/152 series of aircraft can be fitted with a specifically designed BRS manufactured General 
Aviation Recovery Device - GARD-150 parachute system. The system uses a rocket for deployment and is approved for 
fitment by a Federal Aviation Administration (FAA) Supplemental Type Certificate (STC). The rocket deploys the 
parachute through a fabric covering in the rear upper fuselage area. 


13.16.14 The Cessna 172 and 182 aircraft can also be fitted with a BRS parachute by STC. The BRS installations in 
these aircraft position the rocket in the baggage compartment at the rear of the cabin area and the parachute is ejected 
through the right half of the rear window. The forward parachute attachment straps are routed from the exit point across 
the upper centerline area of the fuselage beneath a fiberglass fairing unit. 





1. The BRS Inc website quotes an exit speed of 100 mph. Regardless, the exit speed is significant and represents a serious danger. 
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Warning decal 





Figure Ill-13-13. Side view of rear of Cirrus aircraft highlighting 
the CAPS warning decals on fuselage 





Figure Ill-13-14. Warning decal on Cirrus aircraft 
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Sting T-2000, Pipistrel Virus and Sinus Aircraft and Ultralight Aircraft 


13.16.15 The Sting TL-2000 aircraft uses the rocket-powered Galaxy Recovery Systems (GRS) installation as do 
the Pipistrel Virus and Sinus aircraft. This system is installed in the rear cabin area of the aircraft and projects the 
parachute through the rear cabin window area. Once the parachute has been deployed, the rocket continues beyond the 
canopy until the propellant is spent and then falls away to the ground. 


13.16.16 Other ultralight aircraft use one of several styles of parachute depending on the type of aircraft. Some of 
these systems deploy in an upward direction, while others deploy downward or rearward. Systems from BRS, GRS and 
others were identified as installed in these aircraft. The BRS website reveals a list of over 100 different mounting 
installations, in both ultralight and other types of aircraft such as hang gliders and gyrocopters. 


Danger markings and accident site safety 


13.16.17 There are a variety of warning markings on aircraft to indicate the presence of the parachute systems. On 
the Cirrus aircraft there is a small black text warning that is placed adjacent to the unmarked exit point for the parachute 
(see Figure IIl-13-13). The largest size text on the warning is about 6 mm high. The Cirrus warning is not conspicuous 
and could easily be overlooked following an accident. 


13.16.18 The Cirrus warning decal states the following (see Figure III-13-14): 


WARNING! 
ROCKET FOR PARACHUTE DEPLOYMENT INSIDE 
STAY CLEAR WHEN AIRPLANE IS OCCUPIED 


There are no warning markings printed on the rocket motor canister. There are also no markings on the aircraft’s 
fuselage to delineate the exit path of the forward harness straps on the aircraft, or that clearly mark the outline of the 
concealed hatch above the parachute. 


Chapter 14 


MAINTENANCE INVESTIGATION 


14.1 PURPOSE 


14.1.1 A maintenance investigation reviews the maintenance history of the airplane, the actions of the 
maintenance organization and its staff and the programme under which it was maintained to determine: 


a) whether the aircraft has been maintained in accordance with the applicable airworthiness and 
maintenance regulations of the cognizant licensing authority, including the suitability of such 


regulations; 


b) the relevance of maintenance information to the accident that may suggest particular lines of 
investigation; and 


c) any maintenance actions or materiel factors which were a contributing cause or a root cause of the 
accident/incident. 


14.2 SCOPE 


14.2.1 A maintenance investigation encompasses three categories; adequacy of maintenance performed, 
maintenance management capability and human factors. 


14.2.2 The investigation is a thorough examination of extensive details, particularly in the case of accidents 
involving a transport category airplane. Principle areas to be examined include: 


a) The operating history of the airframe, engines, propellers and components. This includes any events 
resulting in defects or irregular operations that have occurred. 


b) The aircraft records, to establish: 
1) That all applicable airworthiness directives have been incorporated in the airplane. 
2) That all major repairs and alterations incorporated on the airplane were performed in accordance 
with applicable regulations and accepted industry practice and were approved by the State of 
Registry. 


3) That the approved maintenance programme has been followed correctly. 


4) That the administrative and technical procedures of the maintenance programme used comply 
with the regulations of the State of Registry. 


5) That any discrepancies or omissions associated with the airplane have been properly corrected. 


Ill-14-1 
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14.3 INVESTIGATING MAINTENANCE ERROR 
14.3.1 Like operational errors, maintenance errors rarely occur in isolation. Investigators who suspect or discover 
one or more maintenance errors must delve deeply into all factors that may have contributed to the final error(s). The 
following paragraphs represent many of the factors to be evaluated but are not an exhaustive list. 
Information 

14.3.2 Information refers to the written or computerized source data that a maintenance technician needs to carry 
out a task or job. It includes workcards, maintenance manual procedures, service bulletins or engineering orders, 
maintenance tips, illustrated parts catalogues and other manufacturer supplied or internal resources. To determine that 
information was a contributing factor to the maintenance error, either the information itself must be problematical 
(e.g. hard to understand, not complete, conflicting), or the information should have been used but was not (e.g. it was 
not available, it was ignored). If it is expected that the maintenance technician has this information memorized, then refer 


to the Technical Knowledge/Skills section. 


14.3.3 For any particular source of maintenance information that is considered worthy of further evaluation look 
for the following conditions: 


a) Not understandable; 
1) Unfamiliar words or acronyms; 
2) Unusual or non-standard format; 
3) Poor or insufficient illustrations; 
4) Not enough detail or missing steps; and 
5) Poorly written procedures; 
b) Unavailable/inaccessible; 
1) Procedure does not exist; 
2) Not located in correct or usual place; and 
3) Not located near worksite; 
c) Incorrect; 
1) Missing pages or revisions; 
2) Does not match airplane configuration; 
3) Transferred from source document incorrectly; 


4) Steps out of sequence; 
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5) Not the most current revision; and 


6) Procedure does not work; 


d) Too much/conflicting information; 
1) Similar procedures in different resources do not agree (e.g. MM versus task card); 
2) Too many references to other documents; 
3) Configurations shown in different resources do not agree; and 
4) Similar action for two different applications (e.g. hydraulic supply and return lines attach to 
housing next to each other with same size and colour of fitting allowing easy misinstallation); 
e) Update process is too long/complicated; 
1) Requested revisions have not been incorporated yet; 
2) Configurations changed by Service Bulletins or Engineering Orders have not been updated in 
applicable maintenance procedures; and 
3) Document change requests are not submitted or are lost or incorrectly filled out; 
f) Incorrectly modified manufacturer's MM/SB; 
1) Intent of manufacturer’s procedure is not met; 
2) Non-standard practices or steps are added; and 
3) Format does not match rest of procedure or other procedures; 
g) Information not used; 
1) Procedure available but ignored; and 
2) Technician too familiar with procedure; and 
h) Other; 
1) Operator cannot use digital information (this may be more likely at outstations). 
Equipment/tools/parts 
14.3.4 Equipment and tools refer to things such as non-destructive test equipment, work stands, calibrated torque 


wrenches, screwdrivers, test boxes, and special tools called out in maintenance procedures. Parts refer to airplane parts 
that are to be replaced. 
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14.3.5 Unsafe equipment and tools may cause a maintenance technician to become distracted from the task due 
to concern for personal safety. If equipment or tools are not available or are inaccessible, the maintenance technician 
may use other equipment or tools that are not fully suited for the job. Other factors that can contribute to error include 
miscalibrated instruments, use of unreliable equipment, or equipment or tools with no instructions for use. 


14.3.6 Incorrectly labeled parts can contribute to improper installation or repair. Parts that are unavailable can 
contribute to error by the maintenance technician who uses a substitute part, or may even omit parts such as shims. 


14.3.7 If equipment, tools or parts are suspected, investigate for the following conditions: 
a) Unsafe; 
1) Platform moves and is unstable; 
2) Brakes or safety devices inoperative; 
3) Non-skid material worn or missing; 
4) A lock-out mechanism is missing or faulty; 
5) Placards (warnings or cautions) are missing or faded; 
6) Sharp edges are exposed or personal protective devices are missing; and 
7) Power sources are not labelled or protected; 
b) Inaccessible; 
1) Not in usual location (possibly being used on other task or airplane); and 
2) Too far away from the worksite; 
c) Unreliable; 
1) Intermittent or fluctuating readings on dials or indicators; 
2) Damaged or worn out; 
3) Expired use limits; and 
4) Part with history of defects; 
d) Poor layout of controls or displays; 
1) Easy to read wrong display or use wrong control; 
2) Awkward locations, hard to reach; 
3) Too small to read or control; and 


4) Directional control of knobs or dials is not clear; 
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e) 


Miscalibrated; 

1) Tool out of calibration from the start of use; and 

2) Wrong specifications used during calibration procedure; 
Unavailable; 

1) Is not owned or in stock; and 

2) Not available for procurement; 

Inappropriate for the task; 

1) Standard hand tools used for leverage; 

2) Not capable of handling weights, forces, or pressures required for the task; 
3) Wrong or outdated (part) dash numbers; 

4) Connections or grips not the right size; 

5) Parts obtained from uncontrolled store, e.g. a toolbox; and 
6) ‘Bogus’ or unauthorised parts; 

Can’t use in intended environment; 

1) Not enough space to operate tool or install part; and 

2) Requires level surface where none is available; 

No instructions; 

1) Instructional placards missing or faded; 

2) Directional markings missing; and 

3) Tool usage instructions not available; 

Too complicated; 

1) Tool usage requires too many simultaneous movements and/or readings; 
2) Fault isolation or testing is too complex; and 

3) Installation of part requires too much time; 

Incorrectly labelled; 


1) Hand marked labelling or operating instructions are incorrect; 
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2) Wrong part number on tool or part; and 
3) Illegible labels; 
l) Not used; 
1) Equipment/tool/part is available but not used; and 
2) Notall parts installed during multiple installation; and 
m) Other; 
1) System protection devices on tools/equipment not available; and 


2) Parts are fragile, damaged during installation. 


Airplane design or configuration 


14.3.8 An airplane should be designed and configured so that parts and systems are accessible for maintenance. 
The maintenance technician should be able to reach a part, should be able to remove it, and should be able to easily 
replace the part in the correct orientation. When reviewing accessibility as a contributor to maintenance error, it must be 
seen as a real contributor to the error and not just as an inconvenience to the maintenance technician. 


14.3.9 Good designs also incorporate feedback that helps the maintenance technician know that something has 
been performed correctly. For example, an electrical connector that has a ratchet effect provides feedback to the 
maintenance technician when the installation is correct. If this ratchet effect is included in some connectors and not 
others, this could contribute to error. If a maintenance technician goes from a ratchet connector to a non-ratchet 
connector, the technician may over-tighten the second connector looking for the ratchet. 

14.3.10 Configuration variability between models and airplanes can contribute to error when there are small 
differences between the configurations that require maintenance tasks to be carried out differently or require slightly 


different parts. 


14.3.11 Consider if aircraft design or configuration contributed to suspected maintenance errors when investigators 
find any of the following conditions: 


a) Complex; 
1) Fault isolation on the system or component is difficult; 
2) Installation of components is confusing, long, or error prone; 


3) Multiple similar connections exist on the system or component (electrical, hydraulic, pneumatic, 
etc.); 


4) Installation tests for the component are extensive and confusing; and 


5) Different sized fasteners can be installed in multiple locations; 
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b) Inaccessible; 
1) Components or area to be maintained is surrounded by structure; 
2) No access doors exist in the maintenance area; 
3) Area lacks footing space or hand-holds; and 
4) Small or oddly-shaped area; 
c) Not user friendly; 
1) Lack of feedback provided by component or system; 
2) Can be easily installed with wrong orientation; and 
3) Direction of flow indicators do not exist; 
d) Configuration variability between models/airplanes; 
1) Similar parts on different models are installed differently; and 


2) Airplane modifications have changed installation or other maintenance procedures between 
airplanes; and 


e) Other; 


1) Components are too heavy for easy removal/installation. 


The maintenance job/task 
14.3.12 A maintenance technician’s work can logically be separated into a series of tasks. Under certain 
circumstances, when the tasks are poorly planned and/or combined, the work can quickly become unmanageable. If the 
investigator feels the task was a contributing factor, the investigator should analyze the combination or sequence of 
tasks. The investigator, when examining the task sequencing, should also determine whether written information was 
being used and what technical skills and knowledge were expected of the maintenance technician. 
14.3.13 Determine whether the particular job or task involved any of the following conditions: 


a) Repetitive/monotonous; 


1) Similar steps are performed over and over (opening and closing circuit breakers during a long 
test); and 


2) The same task performed many times in multiple locations (removing seats, inspecting lap joints 
for cracks); 


b) Complex/confusing; 


1) Multiple other tasks are required during this task; 
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9) 


2) Multiple steps required at the same time by different maintenance technicians; 
3) Long procedure with step sequences critical; 

4) System interacts with other systems during testing or fault isolation; 
5) Multiple electrical checks are required; and 

6) Task requires exceptional mental or physical effort; 

New task or task change; 

1) New maintenance requirement or component; 

2) Revision to a procedure; 

3) Engineering modification to existing fleet; and 

4) New airplane model; 

Boredom/complacency; 

1) Detachment of maintenance technicians due to low workload; 

2) Failure to vary maintenance technician assignments; and 

3) Under use of maintenance technician skills; 

Technician’s inadequate planning/prioritization of tasks; 

1) Frequent work interruptions to get tools or parts; 

2) Failure to perform preparation tasks first; 

3) Too many tasks scheduled for limited time period; and 

4) Tasks necessary for safety not performed first; 

Different from other similar tasks; 

1) Same procedure on different models is slightly different; 

2) Recent change to airplane configuration has slightly changed task; and 
3) Same job at different worksites is performed slightly differently; and 
Other; 


1) The workgroup performs the task differently than called out in the source data (or written 
information). 
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Maintenance technician/engineer technical knowledge/skills 


14.3.14 Technical skills (sometimes also referred to as abilities) refer to tasks or subtasks that maintenance 
technicians are expected to perform without having to refer to other information. Technical skills include such things as 
being able to lock wire, use a torque wrench, and remove common parts from an airplane. For (lack of) technical skills to 
be a contributing factor to error, the technician must be lacking a skill that was generally expected of the technician. 


14.3.15 Technical knowledge refers to the understanding of a body of information that is applied directly to 
performing a task. Technical knowledge, in order to be a contributing factor to error, is knowledge that is supposed to be 
known (memorized) by the maintenance technician. Three broad categories of knowledge are required of a technician: 
airline process knowledge, airplane systems knowledge, and maintenance task knowledge. These are discussed in 
more detail below. 
14.3.16 Airline process knowledge refers to knowledge of the processes and practices of the airline or repair 
station in which the maintenance technician works. Examples include shift handover procedures, parts tagging 
requirements, and sign-off requirements. While this knowledge is generally acquired through general maintenance 
operating procedures and on-the-job discussion with peers, it may also be acquired from other sources such as 
employee bulletins and special training. 
14.3.17 Aircraft system knowledge refers to knowledge of the physical aircraft systems and equipment. Examples 
include location and function of hydraulic pumps and rework options for corroded or damaged parts. While this 
knowledge is generally acquired from the airplane design characteristics, training, maintenance manuals, and on-the-job 
discussion with peers, it may also be acquired from other sources such as trade journals and maintenance tips. 
14.3.18 Maintenance task knowledge refers to the specific knowledge required to perform a unique task. Examples 
include the procedure for bleeding a hydraulic system and limits for wear of a tire. While this knowledge is generally 
acquired through maintenance instructions or on-the-job discussions with peers, it may also be acquired from airplane 
placards, design characteristics, or even other maintenance technicians when working as a team. 
14.3.19 When investigating the technical competency of the maintenance technician/engineer, look for evidence of: 

a) Inadequate skills; 

1) History of similar, frequently made errors; 


2) Poorly installed or serviced items when procedures were available and straightforward; 


3) History of poor performance after extensive training in tasks, airline processes, and airplane 
systems; and 


4) Trouble with memory items or poor decision making; 
b) Inadequate task knowledge; 
1) Slow task completion; 
2) Technician change of maintenance responsibilities; 
3) Task performed by maintenance technician for the first time; and 


4) Task performed in wrong sequence; 
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c) Inadequate airline process knowledge; 
1) Failure to acquire parts on time; 
2) Technician new to airline or to type of work (from line to hangar, etc.); and 
3) Airline processes not documented or stressed in training; 
d) Inadequate airplane system knowledge; 
1) Technician changes airplane types or major systems; and 
2) Fault isolation takes too much time or is incomplete; and 
e) Other; 
1) Technician performance/skills not accurately tracked/measured; and 


2) The expectations and performance of the technician’s peers — would another technician have 
done the same thing? 


Factors affecting individual performance 


14.3.20 Factors affecting individual performance vary from person to person and include factors brought to the job 
by individuals (e.g., body size/strength, health, and personal events) and those caused by outside factors (e.g. peer 
pressure, time constraints, and fatigue caused by the job itself). These factors may help explain errors made by 
maintenance technicians who are usually top performers. 


14.3.21 Physical health includes the acuity of human senses as well as physical conditions and physical illnesses. 
Human senses, especially vision, hearing, and touch, play an important role in maintenance. Technicians are frequently 
required to perform tasks that are at or near the limits of their sensory capabilities. For example, some tasks require 
good vision and/or touch, such as visual inspection for cracks or finger inspection for burrs. Good hearing is also 
required in order to hear instructions or feedback before and during a maintenance task. 


14.3.22 Physical conditions, such as headaches and chronic pain, also have been shown to relate to errors. 
Alcohol/drug use, as well as side effects of various prescription and over-the-counter medicines, can negatively affect 
the senses. Physical illness, such as having a cold or the flu, can also negatively affect the senses and the ability to 
concentrate. Illnesses can also lead to less energy, which can affect fatigue. 


14.3.23 Fatigue has been defined by the U.S. Federal Aviation Administration (FAA) as a depletion of body energy 
reserves, leading to below-par performance. Fatigue may be emotional or physical in origin. Acute fatigue may be 
caused by emotional stress, depletion of physical energy, lack of sleep, lack of food, poor physical health, or over 
excitement. Fatigue may also be caused by the work situation itself. The time of the day, the length of time one has been 
working, and complex mental tasks or very physical tasks can cause fatigue. 


14.3.24 Time constraints or time “pressure” are common to the maintenance technician. The need to finish a 
maintenance task so an airplane can be released from the gate or to finish a heavy maintenance task so an airplane can 
be put back into service often causes technicians to feel pressure to get their tasks done. Studies have linked both too 
little time and too much time with increased error. There is a well known speed/accuracy trade-off, in that the faster one 
tries to finish a task the more likely an error is to happen. This trade-off also holds for speed and safety. However, when 
things are done too slowly, boredom can set in and also increase the chance of errors. 
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14.3.25 Peer pressure can also influence a maintenance technician’s performance. For example, there may be 
peer pressure not to use maintenance manuals because it is seen as a sign of lack of technical knowledge. Peer 


pressure may also influence a technician’s safety-related behaviour. 


14.3.26 Body size and strength are two obvious factors that affect a maintenance technician’s ability to perform a 
task. If someone is too small to reach a plug or if someone is unable to let down an LRU from an upper rack, this can 


contribute to error. 


a) Physical health: 


1) 
2) 


3) 


Sensory acuity (e.g. vision loss, hearing loss, touch); 
Failure to wear corrective lenses; 

Failure to use hearing aids or ear plugs; 

Restricted field of vision due to protective eye equipment; 
Pre-existing disease; 

Personal injury; 

Chronic pain limiting range of movement; 

Nutritional factors (missed meals, poor diet); 


Adverse affects of medication; 


10) Drug or alcohol use; 


11) Complaints of frequent muscle/soft tissue injury; and 


12) Chronic joint pain in hands/arms/knees. 


b) Fatigue: 


Lack of sleep; 

Emotional stress (e.g. tension, anxiety, depression); 
Judgment errors; 

Inadequate vigilance, attention span, alertness; 

Inability to concentrate; 

Slow reaction time; 

Significant increase in work hours or change in conditions; 


Excessive length of work day; 
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9) Excessive time spent on one task; 

10) Chronic overloading; 

11) Task saturation (e.g., inspecting rows of rivets); 

12) Excessive length of duty; 

13) Travelling time before commencement of duty; and 

14) Circadian effects (e.g. night shift working, time zone changes). 
Time constraints: 

1) Constant fast-paced environment; 

2) Multiple tasks to be performed by one person in a limited time; 
3) Increase in workload without an increase in staff; 

4) Too much emphasis on schedule without proper planning; 


5) Perceived pressure to finish a task more quickly than needed in order to release the airplane from 
the gate; and 


6) Unrealistic Return-to-Schedule times which do not take account of actual time needed for specific 
maintenance tasks. 


Peer pressure: 

1) Unwillingness to use written information because it is seen as a lack of technical skills/knowledge; 
2) Lack of individual confidence; 

3) Not questioning other’s processes; and 

4) Not following safe operating procedures because others don't follow them. 
Body size/strength: 

1) Abnormal reach, unusual fit, or unusual strength required for the task; and 
2) Inability to access confined spaces. 

Personal event: 

1) Death of a family member; 

2) Marital difficulties; 


3) Change in health of a family member; 
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4) Change in work responsibilities/assignment; and 


5) Change in living conditions. 


g) Workplace distractions/interruptions during task performance: 
1) Confusion or disorientation about where one is in a task; 
2) Missed steps in a multi-step task; 
3) Not completing a task; and 
4) Working environment is too dynamic. 

h) Other: 
1) Absenteeism; 
2) Vacations; 
3) Medical leave; 
4) Hazardous attitudes (anti-authority, invulnerability, resignation); and 
5) Risk-taking behaviour. 

Environment and facilities 
14.3.27 The working environment and facilities can contribute to error. For example, temperature extremes (either 


too hot or too cold), high noise levels, inadequate lighting (reflection/glare, etc.), unusual vibrations, and dirty work 
surfaces could all potentially lead to maintenance errors. Concerns about health and safety issues could also contribute 
to maintenance technician errors. Look for: 


a) 


High noise levels; 

1) High noise impacts the communication necessary to perform a task; 

2) Extended exposure to noise reduces ability to concentrate and makes one tired; and 
3) Noise covers up system feedback during a test; 

Hot environment; 

1) Work area is too hot so the task is carried out too quickly; 

2) Extremely high temperatures cause fatigue; 

3) Long exposure to direct sunlight; and 


4) Exterior components or structure too hot for maintenance technicians to physically handle or work 
on; 
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Cold environment; 

1) Work area is too cold so the task is carried out too quickly; 

2) Long exposure to low temperature decreases manual dexterity; and 
3) Extremely low ambient temperature creates difficult maintenance environment; 
Humidity; 

1) High humidity creates moisture on airplane, part and tool surfaces; and 
2) Humidity contributes to fatigue; 

Rain; 

1) Causes obscured visibility; 

2) Causes slippery or unsafe conditions; 

3) Makes using written material difficult; and 

4) Protective gear makes grasping, movement difficult; 

Snow; 

1) Causes obscured visibility; 

2) Causes slippery or unsafe conditions; and 

3) Protective gear makes grasping, movement difficult; 

Lighting; 

1) Insufficient for reading instructions, placards, etc.; 

2) Insufficient for visual inspections; 

3) Insufficient for general maintenance activity; and 

4) Excessive, creates glare, reflection, or eye spotting; 

Wind; 

1) Interferes with ability to hear and communicate; 

2) Moves stands and other equipment (creates instability); 

3) Blows debris into eyes, ears, nose or throat; and 


4) Makes using written material difficult; 
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i) 


Vibrations; 

1) Use of power tools fatigues hands and arms; 

2) Makes standing on surfaces difficult; and 

3) Makes instrument reading difficult; 

Lack of cleanliness; 

1) Loss of footing/grip due to dirt, grease or fluids on parts/surfaces; 
2) Clutter reduces available/usable work space; and 

3) Inhibits ability to perform visual inspection tasks; 


Hazardous/toxic substances; 


= 


) Reduces sensory acuity (e.g. smell, vision); 

2) Exposure causes headaches, nausea, dizziness; 

3) Exposure causes burning, itching, general pain; 

4) Personal protective equipment limits motion or reach; 
5) Causes general or sudden fatigue; and 

6) Causes general concern about long term effect on health; 
Power sources; 

1) Not labeled with caution or warning; 

2) Guarding devices missing or damaged; 

3) Power left on inappropriately; 

4) Circuit protection devices not utilized or damaged; and 
5) Cords chafed, split, or frayed; 


Inadequate ventilation; 


= 


) Strong odour present; 
2) Burning or itching eyes; 
3) Shortness of breath; and 


4) Sudden fatigue; and 
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n) Other; 
1) Area(s) not organized efficiently (difficult to find parts, work cards, etc.); and 


2) Area too crowded with maintenance technicians and/or other personnel. 


Organizational environmental issues 
14.3.28 The organizational culture can have a great impact on maintenance error. Factors such as internal 
communication with support organizations, trust level between management and maintenance technicians, management 
goals and technician awareness and support of those goals, union activities and attitudes, morale, etc., all affect 
productivity and quality or work. The amount of ownership the technician has of the work environment and the ability to 
change or improve processes and systems is of key importance to the technicians’ morale and self esteem which, in turn, 
affects the qualify of task performance. Examples to look for: 
a) Quality of support from technical organizations; 
1) Inconsistent quality of support information; 
2) Late or missing support information; 
3) Poor or unrealistic maintenance plans; 
4) Poor or missing task pre-planning; 
5) Lack of feedback on change requests; 
6) Reluctance to make technical decisions; and 
7) Frequent changes in company procedures and maintenance programmes; 
b) Company policies/work processes; 
1) Unfair or inconsistent application of company policies; 
2) Standard policies do not exist or are not emphasized; 
3) Standard error prevention strategies don’t exist or are not applied; 
4) _Inflexibility in considering special circumstances; 
5) Lack of ability to change or update policies; and 
6) Policies inhibit reporting of errors and therefore inhibit process improvements; 
c) Unions; 
1) Contract negotiations create distractions; 


2) Historical management/labour relations are not good; 
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3) Positive or negative communication from union leadership; and 

4) Strike, work slowdown, or other labour action creates a disruption; 
d) Unstable work force; 

1) Layoffs are occurring; 

2) Early retirement programmes drain experience; 

3) Reorganizations, consolidations and transfers cause more people to be in new jobs; 

4) Demotions and pay cuts; and 

5) Frequent management changes; and 
e) Other; 

1) Company is acquired by another company; 

2) Work previously accomplished in-house is contracted out; and 


3) Overall inadequate staffing levels. 


Leadership and supervision 
14.3.29 Even though supervisors normally do not perform the tasks, they still contribute to maintenance error by 
poor planning, prioritizing, and organizing of job tasks. Delegation of tasks is a very important supervisory skill and if not 
done properly, can result in poor work quality. Also, there is a direct link between the management/supervisory attitudes 
and expectations of the maintenance technician and the quality of the work that is performed. 
14.3.30 Also, supervisors and higher-level management must also provide leadership. That is, they should have a 
vision of where the maintenance function should be headed and how it will get there. In addition, leadership is exhibited 
by management “walking the talk,” that is, showing the same type of behaviour expected of others. 
14.3.31 Investigators should make themselves aware of leadership and supervision inadequacies: 
a) Poor planning/organization of tasks; 

1) Excessive downtime between tasks; 

2) Not enough time between tasks; 

3) Paperwork is disorganized; 


4) Tasks are not in a logical sequence; and 


5) Airplane configurations are changed too frequently during the maintenance visit; 
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Inadequate prioritization of work; 

1) Technicians not told which tasks to carry out first; 

2) Important or safety related tasks are scheduled last; and 

3) Fault isolation is not performed with the most likely causes checked first; 


Inadequate delegation/assignment of tasks; 


= 


) Assigning the wrong person to carry out a task; 

2) Inconsistency or lack of processes for delegating tasks; 

3) Giving the same task to the same person consistently; and 

4) Wide variance in workload among maintenance technicians or departments; 
Unrealistic attitude/expectations; 


1) Frequent dissatisfaction, anger, and arguments between a supervisor and a technician about how 
to do a task or how quickly a task should be finished; 


2) Pressure on maintenance technicians to finish tasks sooner than possible or reasonable; 
3) Berating individuals, especially in front of others; 

4) Zero tolerance for errors; and 

5) No overall performance expectations of maintenance staff based on management vision; 
Excessive supervision; 

1) “Look over the shoulder’ management style (micromanagement); 

2) Frequent questioning of decisions made; and 

3) Failure to involve employees in decision making; and 

Other; 

1) Not enough supervision; 

2) Meetings do not have purpose or agendas; 

3) Supervisor does not have confidence in group’s abilities; and 


4) Management doesn’t “walk the talk” and thereby sets poor work standards for maintenance staff. 
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Communication issues 


14.3.32 Communication issues refer to breakdowns in communication that prevent the maintenance technician 
from getting the correct information regarding a maintenance task in a timely manner. The types of communication 
include both written and verbal. 


14.3.33 Issues which influence effective maintenance actions include communications: 


a) 


qd) 


Between departments; 


= 


) Written communication incomplete or vague; 

2) Information not routed to the correct groups; 

3) Department responsibilities not clearly defined or communicated; 

4) Personality conflicts create barriers to communication between departments; and 
5) Information not provided at all or not in time to use; 

Between people (peers); 

1) Failure to communicate important information; 

2) Misinterpretation of words, intent or tone of voice; 

3) Language barriers; 

4) Use of slang or unfamiliar terms; 

5) Use of unfamiliar acronyms; 

6) Failure to question actions when necessary; 

7) Failure to offer ideas or process improvement proposals; and 

8) Personality differences; 

Between shifts; 

1) Work handover not accomplished or done poorly or hurriedly; 

2) Inadequate record of work accomplished — incomplete stage sheets; 
3) Processes not documented for all shifts to use; and 

4) Job boards or check-off lists not kept up to date; 

Between crew and lead; 


1) Lead fails to communicate important information to crew; 
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2) Poor verbal handover or job assignment at the beginning of a shift; 
3) Unclear roles and responsibilities; 
4) Lead does not provide feedback to crew on performance; 
5) Crew fails to report problems and opportunities for improvement to lead; and 
6) Communication tools (written, phones, radios, etc.) not used; 
e) Between lead and management; 
1) Little or no communication exists; 
2) Goals and plans not discussed regularly; 
3) No feedback from management to lead on performance; 
4) Lead does not report problems and opportunities for improvement to management; and 
5) Management fails to communicate important information to lead; and 
f) Other; 
1) Computer or network malfunctions lead to loss of information; 
2) E-mail not used or ignored; and 


3) Computer-based manuals and systems not available at outstations. 


14.4 MAINTENANCE GROUP 


14.4.1 Air carrier accidents and serious incidents are often investigated by a team. In a team investigation, an 
airworthiness specialist is usually assigned as maintenance group chairperson to manage the group. The chairperson in 
coordination with the Investigator-in-Charge (IIC) defines the precise composition of the group. 


Composition 


14.4.2 At a minimum, the group should consist of the group chairperson, representatives of the states 
participating in the investigation, and advisers from the airframe and powerplant manufacturer. Representatives and/or 
advisers from other parties to the investigation should be included as needed. Parties assigned to the maintenance 
group should be able to address powerplant, structures, systems, and operations questions that will arise. 


14.4.3 The group chairperson should consider including an individual from either the operator's maintenance 
quality assurance or maintenance engineering department. The individual assigned must have the ability to assist in 
deciphering airplane maintenance log write-ups and have an excellent understanding of the operator's maintenance 
programme and general maintenance manual. 
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14.4.4 It is helpful to include one of the company’s technical personnel and a certificated mechanic/engineer 
(employed by the operator or third party provider) be placed on standby to assist in explaining any unclear or confusing 
write-ups in the records. Mechanics, more than anyone else, will be able to decipher and explain log book, task card and 
other write-ups. They understand the culture and “tribal wisdom” of the maintenance community and an awareness of 
sub-rosa maintenance practices. They are aware of the idiosyncrasies of the design as well as work-arounds to chronic 
problems that never seem to be reported. 


14.4.5 Finally the group chairperson should request that the owner/operator or contract Maintenance Repair 
Organization (MRO) facility place a person responsible for maintenance records on call. There will be numerous 
requests for data retrieval and clarification. 


Duties and responsibilities 


14.4.6 The maintenance group is responsible for reviewing all maintenance records to expose the service and 
maintenance history of the aircraft involved in an accident. 


14.4.7 The collected data will be studied to determine the effectiveness of the maintenance performed and the 
adequacy and its relevance to issues associated with the accident. The significance of improper or inadequate 
maintenance, servicing, or inspection of an aircraft becomes most evident after a thorough review of the relevant records. 


14.4.8 These data may indicate a need to explore further any records relative to the aircraft type under 
investigation. They may also suggest lines of investigation to other groups. Correspondingly, data collected by other 
groups may suggest lines of investigation for the maintenance group. 


14.4.9 The maintenance group chairperson will alert the investigative team to any system or component that 
becomes suspect through the records review. In this manner, the group will reduce the potential for overlooking possible 
system or “hardware”-related accident causes. 


14.4.10 Investigators must consider operator differences and the regulations that govern them. Large air carriers, 
commuter air carriers, on-demand air taxi, and operators of large aircraft are regulated by a body of regulations that is 
rigid and thorough. Corporate- or VIP-use airplanes are frequently operated under General Operating rules. It is, 
therefore, important to review the approved maintenance programme with respect to the applicable operating regulations. 


14.4.11 The adequacy of a maintenance programme should never be assumed based upon the size or apparent 
sophistication of its operation or records system. 
Specific focus 


14.4.12 During the investigative process, the maintenance group should focus, as necessary, on the following 
specific objectives: 


a) Collecting sufficient maintenance history to serve as a reference for all members of the investigative 
team. 


b) Researching and evaluating the maintenance aspects of specific issues presented to the maintenance 
group by other group chairpersons or the Investigator-in-Charge (IIC). 


c) Analyzing previous maintenance activities and trends associated with the accident aircraft in an 
attempt to uncover issues that may not be discernible to other groups because of the destruction of 
systems and structures evidence. 
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d) Reviewing the operator's, repair station’s, and contract maintenance provider’s programmes, policies, 
procedures, and work environment to determine whether any of these may have contributed to the 
accident. 


e) Evaluating responsible regulatory agencies’ oversight of the operator to determine whether it may 
have contributed to the accident sequence. 


Note.— Operations and maintenance of aircraft may have regulatory oversight by various government 
agencies other than the aeronautical technical regulation organizations, for example, hazardous materials, security, 
health and safety and environmental agencies. 


Coordination 


14.4.13 The group must maintain close coordination with the IIC. The investigation may well point to significant 
areas of investigation by other specialists. In turn it may be necessary for the maintenance investigation to study 
particular aspects which have come to the attention of others engaged elsewhere in the investigation. 


14.4.14 The group’s duties require coordination with the operator. An investigation may extend into design, 
certification, manufacturing, and/or maintenance management. This may include standards and procedures, quality 
assurance, equipment and facilities, maintenance personnel selection, training, materials control and regulatory 
oversight issues. 


14.4.15 Before reviewing any records, provide each group member an index sheet delineating the Air Transport 
Association (ATA) chapter codes. Almost every piece of data reviewed will reference these codes. Divide the working 
group by assigning each person certain relevant ATA codes. 


14.4.16 Coordinate with the IIC to decide the extent and priorities of the review. Decide on documents to be copied 
or data to be extracted for the group report. 


14.4.17 Hold daily progress meetings to make the group aware of the entire effort. 


14.4.18 It may be necessary for the group chairperson to discuss the areas that their particular group will be 
focusing on and the type of expertise needed by members of the group. 


Operator maintenance programme briefing 


14.4.19 As soon as possible after convening the group, the group chairperson should advise the owner/operator 
that the group will need to be briefed on the operator’s approved maintenance programme. A complete understanding of 
an operator's maintenance programme is essential. It will normally be necessary to enlist the assistance of the operator 
and, in the case of accidents involving aircraft of another State, coordination with that State’s Accredited Representative 
is necessary. 


14.4.20 Before reviewing documentation that relates specifically to maintenance performed on the accident aircraft 
or the operators maintenance programme, it is essential that the operator brief the group about the maintenance 


programme and activities they are about to review. 


14.4.21 The group chairperson and the operator should establish the agenda for this briefing. Consider the 
following topics: 


a) Organization of the maintenance department including functional relationships. 
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b) Type of maintenance programme authorized and under what body of regulation it is performed. 


c) Scheduled inspection programme. Include type of checks, time intervals, locations where checks are 
performed, description of splitting checks into sub phases or intervals, and a list of those checks 
performed by contract maintenance providers. 


d) Contract maintenance services including the scope and limitations of the services, method of 
coordination for on-call maintenance, operator over-sight/guidance, records movement and tracking of 
work performed. 


e) Minimum Equipment List (MEL) programme. Include tracking process, notifications, clearing 
procedures, etc. 


f) Airworthiness Directive (AD) compliance programme. Include tracking system, repetitive inspection 
compliance methods, procedure for converting applicable portions of ADs to engineering orders (EO) 
or engineering authorizations (EA). 


g) Records system. Include type of approved system, description of supplemental systems, and method 
of data collection/entry, tracked items/events, and information retrieval/printout capabilities. 


h) Stores department policies and procedures, particularly suspected unapproved parts programme, 
inventory control, segregation of airworthy and non-airworthy parts and oversight of vendors. 


i) Certification Maintenance Requirements (CMR) and Required Inspection Items (RII) control. 


14.5 AIR CARRIER ACCIDENTS 


Notification of owner/operator 


14.5.1 Immediately after notification of the accident and before proceeding, the group chairperson should ensure 
that either the group chairperson or the IIC advise the airplane owner/operator that any and all maintenance records and 
manuals pertaining to the accident airplane are impounded. These must be retained and available for review, 
photographing or copying when requested by the group. 


Note.— Many operators use a complex system of computerized record keeping in addition to their 
regulatory required/approved record programme. These also must be available. This is important to emphasize. 


14.5.2 Normally records for the previous 90 days are requested. However, the records may in some instances 
extend back to the original manufacture of the airplane. 


14.5.3 Unless specified otherwise in the State regulations, the owner/operator is responsible for the publications 
and records’ safekeeping until the group chairperson or the chairperson’s representative arrives to take possession. In 
some situations, the group chairperson may want to request that a local regulatory agency office take possession of 
records until the group arrives. 


14.5.4 Manuals obtained must be versions that are currently released by the operator and manufacturers as of 
the date of the accident. 


14.5.5 It is not necessary for the investigating agency to retain original documents as long as suitable copies of 
necessary records are obtained. 
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14.5.6 After the preliminary steps have been taken to impound the records and establish the group membership, 
the chairperson should proceed to the maintenance facility or other location of the records. 
Identify airplane, powerplant and propeller 
14.5.7 As soon as possible after the accident have the owner/operator complete the Airplane Data form. The 
Appendix to this Chapter shows typical information to record as soon as possible. 
Maintenance certification 
14.5.8 Copies of the Operations Specifications shall be available. These define the operator's scheduled 
maintenance programme including limitations and special authorizations as well as the operator’s weight and balance 
control programme. 
Maintenance records 

Note.— The physical size of the records can be overwhelming. Therefore, all of the following records need 
not be physically presented to the maintenance group but must be available to them upon request. As the line of 
investigation develops, specific records will come into play. 
14.5.9 Records to consider for review include the following examples. 

a) Aijrplane technical logs and, in some instances, flight attendant logs for the last 90 days. As there are 
no industry standards for reporting, most logbook entries and reporting disciplines vary from airline to 
airline and the number of entries cannot be considered indicative of product quality. However, repeat 
write-ups may indicate a problem with the aircraft. 


b) Aircraft maintenance history data for the last 120 days. 


c) Routine and non-routine task cards. All non-routine task cards for the last scheduled check and for the 
last “C” or “D” level check. 


Note.— For a transport-category aircraft, there will be hundreds of cards from these checks. Non- 
routine task cards will yield a wealth of information and suggest lines of investigation. 


d) All repair records for the aircraft's engines, propellers, and primary system components. 


e) Conditional inspection history for life of aircraft. Examples include such occurrences as overweight 
landings, bird strike, lightning strike, aircraft damage reports, etc. 


f) Any maintenance or servicing before final flight including fuelling slips. 
g) A\list of major repairs and alterations. 


h) A list of all Supplemental Type Certificate (STC) work that has been accomplished on the accident 
aircraft. 


i) Engine condition monitoring data for the last 30 days. 
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Engine change log. This provides a history of those airplanes on which a given engine has been 
installed. 


k) Engine and airframe vibration monitoring data. 

1) — List of Minimum Equipment List (MEL) items currently being carried on the accident aircraft. 

m) Report of in-flight shutdowns of powerplants covering the last year. 

n) Configuration Deviation List (CDL) items currently being carried on the aircraft. CDL items are 
identified in Appendix CDL of the Approved Flight Manual (AFM). 

Note.— CDL items define a certificated configuration for the aircraft. As such they do not require 
rectification like MEL items require. 

0) All Airworthiness Directives (ADs) applicable to the accident aircraft. This should include the AD 
compliance record of the aircraft indicating repetitive inspections and/or terminating action. 

p) Service Difficulty Reports (SDR). This is a data collection system intended to be used to provide an 
alert to incipient safety problems with the aircraft. This feedback system encompasses a wide network 
of contributors. 

q) List service bulletins/letters, issued by manufacturers, applicable to the accident aircraft and its 
components. 

r) List cancellations/diversions/deviations for the past 6 months. 

s) Relevant incidents for the accident aircraft (and all others of the same model) for the last 6 months. If 
possible, have data listed separately for each maintenance station. 

t) Weight and balance records of the accident aircraft including the trim sheet calculation for the takeoff 
prior to the accident. 

Note.— Trim sheet calculations are usually held with flight operations records. 
Publications 
14.5.10 Publications required for large aircraft vary with the type of operating rules under which the aircraft was 


being operated. A complete set of all required publications is huge. The documents are published in several formats — 
hard copy, microfilm, microfiche, CDs, or web based. Information relating to the detailed maintenance review can be 
found in the operator's General Maintenance Manual. 


Note.— The physical size of these documents can be overwhelming. Therefore, all of the following 
publications need not be physically presented to the maintenance group but must be available to them upon request. As 
the line of investigation develops, specific maintenance publications will come into play. 


14.5.11 At a minimum the group should start with a copy of the operators’ General Maintenance Manual and the 
aircraft maintenance manual. The following publications are characteristic of aircraft operated under air carrier rules: 
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a) Maintenance publications consist of the airframe, powerplant, and component manufacturers’ 
publications. Examples include maintenance, structural repair, illustrated parts, software controls, 
overhaul, NDT manuals, component maintenance manuals, maintenance bulletins, etc. The 
publications reviewed must have been applicable to the aircraft on the date of the accident. 

b) The appropriate regulatory agency usually requires the operator have a manual system that includes 
maintenance policies and procedures. This material is frequently contained in a document called the 
General Maintenance Manual (GMM). This is an important document for the investigator to 
understand the operator's maintenance programme. It is a basic reference and should be obtained 
early in the investigation and reviewed by all members of the Maintenance Investigation Group. 

c) Copies of all service publications such as service bulletins, all operator letters, maintenance tips, and 
bulletins issued by the operator applicable to the accident airplane. 

d) All maintenance package task cards applicable at the time of the accident or at the time the last 
particular check was accomplished. 

The maintenance review 
General 
14.5.12 The purpose of the maintenance review is to determine: 

a) that work done has been in accordance with current publications including task cards; 

b) that work done and inspections done were accomplished in accordance with the approved 
maintenance programme; 

c) the adequacy of regulatory oversight; 

d) if asuspect part is authentic or is an unapproved part; and 

e) thata part is approved/valid for installation on a particular aircraft. 


These may settle uncertainties or suggest lines of investigation. 


Initial review 
14.5.13 Review the operator’s maintenance programme to develop a working understanding of it. 
14.5.14 Perform a cursory review of the accident aircraft's maintenance log entries and maintenance history 


printout for the last 30 days. This review should focus on maintenance discrepancies that appear to relate to systems 
that are tentatively suspect based on the limited accident sequence information already available. 


Drug testing 


14.5.15 Determine if either the operator or a contract maintenance provider performed maintenance actions on the 
aircraft in the last few days preceding the accident. If they have, now is the time to determine if drug testing of the 
individuals who performed the work will be requested. 
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Weight and balance 
14.5.16 Coordinate this activity with the Flight Operations Group. 


14.5.17 As a part of the initial review, confirm the correctness of weight and balance calculations and stabilizer trim 
setting for the accident aircraft prior to its last flight. This record may be in the flight/dispatch records. Check also that the 
aircraft was correctly loaded. 


14.5.18 Check the compliance date, location, and method used for the last weighing check. If electronic scales 
were used to weigh the aircraft, check the method and date of calibration and certification. 


14.5.19 Audit the last recorded weighing report for correctness. This should include confirmation in the record of 
weight and centre of gravity changes made to the aircraft since its last weighing. 


14.5.20 Confirm that changes to the weighing report were conveyed to appropriate flight operations personnel. 


Detailed review 


14.5.21 The detailed review should be pursued after the other groups have had time to gather sufficient evidence 
to suggest some specific lines of inquiry. In addition to the group’s review of the accident aircraft's maintenance history, 
the following programmes, policies, and conditions should be considered for review as dictated by the investigations line 
of inquiry. 


Maintenance programme, policies 


14.5.22 This material is usually found in the General Maintenance Manual. Contained in this document is found the 
maintenance department's organization, duties and responsibilities including individual group functions such as the 
inspection programme, stores control, weight and balance control, materials control, records administration, engineering, 
etc. 


14.5.23 This manual may be composed of separate documents addressing specific topics. Examples: fuelling, de- 
icing, minimum equipment list, etc. 


Management and regulatory oversight 


14.5.24 Some aircraft accidents have resulted from organizational defects or weaknesses in management and/or 
regulatory oversight; for example, an operator may have prescribed or condoned procedures not commensurate with 
safe operating conditions in practice. Similarly, ambiguous instructions, and those capable of dual interpretation may 
also have existed; these factors may well have stemmed in the first instance from uncritical scrutiny by regulating 
authorities. It may therefore be necessary to inquire closely into other organizations or agencies not immediately or 
directly concerned with the circumstances of the accident but where action, or lack of it, may have permitted or even 
caused the accident to happen. 


14.5.25 Review oversight of the operator or contract repair station by regulatory agency of the state of registry. 
a) Look at the work programme of the principal maintenance inspector (PMI). Document the extent of the 


PMI’s responsibilities, percentage of time spent with this operator, percentage of time spent in each 
major area, and any assistance provided by other inspectors (to include geographic inspectors). 
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b) Evaluate the qualifications and experience of the PMI and any assigned assistant PMls. Include in this 
a review the subject individuals’ pre- (name of regulatory agency) maintenance experience. 


c) Review the reports of PMI’s required inspections, inspection status, inspection information/comments, 
and any trend data for this operator. Review any action letters between the PMI and the operator. 


d) For an operator, if the state conducts formal oversight audits, review these reports. For example, the 
United States’ regulatory agency, the FAA, conducts a National/Regional Aviation Safety Inspection 
Program (NASIP or RASIP). 


e) Interview line-maintenance, hangar-maintenance, shop maintenance and local regulatory agency 
inspectors not associated with the involved operator to gain insight into the PMI’s working relationship 
with the operator’s supervisory maintenance personnel. 


Inspection programme 


14.5.25 This should include review of required inspection items (RII), buy-back procedures, vendor control, 
materials control, continuing analysis and surveillance and return to service. 


Reliability programme 


14.5.27 How does the operator identify and track repeat write-ups, line and hangar maintenance rejects (completed 
maintenance tasks that were determined to be unacceptably performed at inspection sign-off), and “infant mortality” of 
aircraft parts (i.e. recently designed parts with limited service experience determined to be not airworthy when received 
new from the manufacturer). Obtain a copy of the operator’s programme. 


Tool control programme 


14.5.28 Determine how personal and company-owned tools are accounted for after each shift change. Determine 
how a tool is tracked when temporarily at another base. Review procedures followed when a tool appears to be missing. 
Find out what type of inspection the operator performs to make sure personal tool boxes do not contain loose, excess, or 
unapproved hardware. 


Shift-change procedures 

14.5.29 Shift change policies vary widely. Numerous accidents have been ascribed to poor or no work handover. 
Determine how workers on the oncoming shift know where the previous shift stopped work in the performance of any 
uncompleted maintenance tasks. Ensure the programme is really being used and that it identifies any components or 
hardware disconnected or removed simply to gain access to the component being worked on. 


Scheduled inspection programme 


14.5.30 This is found in the Maintenance Operations Specifications. Review the programme to ensure that all items 
for the accident aircraft were being inspected at required intervals. 
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Functional Check Flight (FCF) programme 

14.5.31 Determine what types of maintenance actions require an FCF. Review the operator's programme for FCF 
pilot qualification, maintenance technician participation and qualification, flow chart/checklist usage, and documentation 
of data and final airworthiness determinations. 

Supplemental Structural Inspection Programme (SSIP) 

14.5.32 Review the operators supplemental and corrosion prevention control programme. Make certain the 
required reports are being sent to the Aircraft Certification Office (ACO) and manufacturer for findings of level 2 and 3 
corrosion. Review the aging aircraft inspection status for the fleet. 

Maintenance training programme 

14.5.33 Look at the in-house training programme for engine, airframe and systems, to include curriculum, instructor 
qualification/training, participation percentage, recurrent training, training on special systems, and record-keeping. 
Determine percentage of participation in manufacturer’s resident training courses. Determine workers’ opinion of initial 
and recurrent training. 

Stores programme 

14.5.34 If a specific off-the-shelf part is suspect, review the programme by which the operator receives, inspects, 
and incorporates parts into its system. Review the documentation to make sure that the suspect part was “approved” 
and “airworthy” when installed on the aircraft. Be alert to cure-dated items. Check that parts, especially small parts such 
as rivets, bolts and seals, were issued correctly from an approved store and were not obtained from an uncontrolled 
source such as a toolbox. 

Foreign Object Damage (FOD) programme 

14.5.35 Review programme for hangar, line maintenance and last departure airport for the aircraft. Determine if the 
programmes are actually being used. Check not only the operator’s programme but also the last departure airport's 
programme. 


Publications 


14.5.36 Remember that the actual documents used by individuals involved in the accident may not be 
representative of the most recent version. This is attributable to a number of factors: 


a) distribution delays of revisions to user locations. Most common are printed, microfiche, microfilm, 
digital; 


b) temporary revisions which are easily misplaced or may not be available; 
c) maintenance tips or bulletins (manufacturer’s as well as the operator’s) that are not rigidly controlled; 


d) software media that is not rigidly controlled; 
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e) printed revisions which may be incorrectly posted; 


f) use of materials from previously made copies which are stored in personal tool boxes. make sure that 
this practice is prohibited by the operator; and 


g) locating manual material in locations inconvenient for users. 
14.5.37 Finally be aware of personal notes kept by individual technicians that may or may not be reflective of 
current published maintenance practices, such as training notes or personal ‘black books’. Also check that up-dates 
such as manual revisions, service bulletins and airworthiness directives are available and that time is available for the 
technician to review these periodically. 


14.5.38 The review should assure that: 


a) all applicable publications used by maintenance personnel are up to date as of the date of the 
accident; 


b) all applicable publications are easily available to technicians; 
c) manuals and task cards were used and followed; 


d) instructions and task cards, including illustrations, are clear and unambiguous. It is helpful to interview 
technicians for their opinions; 


e) Illustrations and diagrams are reflective of the aircraft and correct build-up of installed parts. This is 
very important as frequently the only build-up information available to technicians is that shown in 
manuals (IPC, etc.) which present build-up part orientation in an exploded view; 


f) Illustrations warn of possible ambiguity when displaying installation and orientation in order to avoid 
reversed controls; 


g) aircraft applicability is correct; and 
h) instructions reflect the incorporation of AD notes, engineering orders and service bulletins applicable 
to the accident aircraft. 
Maintenance records 


14.5.39 The task of reviewing the maintenance records including those carried in the aircraft and those records 
held at stations through which the aircraft passed is normally conducted at the operator’s station holding the records. 


14.5.40 In addition to the records that the operator is obliged by regulation to retain, there may be other operational 
records which could yield valuable information. The investigator should determine if there are any such records retained 
by the operator but not required by the regulation. 


14.5.41 The investigation should examine all maintenance performed on the aircraft just before the accident and, in 
doing so, determine whether or not it was done properly. 


14.5.42 Maintenance actions accomplished and inspections performed should be reviewed during this process. 
Scheduled inspections (such as preflight, service checks, post flight, phase checks, and periodic inspections, conditional 
inspections, and modifications) should be reviewed to determine if improper actions caused or contributed to the 
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accident. Aircraft records should be carefully reviewed to determine proper and accurate documentation of maintenance 
actions. Identification of personnel involved in maintenance actions should be done from the aircraft records as well as 
from interviews. Interviews should be conducted with technicians, lead person, supervisors and shop managers. Note 
that If several people, such as an engine change crew, are involved in a job, or the job goes over a shift change, the 
names in the records only identify some of the people. 


Aircraft technical and flight attendant logs 


14.5.43 Review the previous log entries for the incident aircraft for the last 90 days. 


14.5.44 Make sure to record the station identifier, mechanic’s identification number, and ATA chapter code for any 
suspicious write-ups or corrective actions. 


14.5.45 Repeated technical log entries against a specific system or LRU may be indicative of either a problem with 
the aircraft or the LRU. 


14.5.46 There have occurred instances involving airworthiness items that have been entered into the flight 
attendant logs. The operator may not have a system for screening the flight attendant log. The consequence is that the 
discrepancy may be missed by the maintenance community and go uncorrected. 

Task cards 

14.5.47 If there is a suspect system or component, the routine task cards signed off during the last applicable 
inspection should be requested. Each action box on the relevant card should be reviewed for inspection findings and 
corrective actions taken. 

14.5.48 Note that for a transport category aircraft, there will probably be hundreds of non-routine task cards from 
the last scheduled check and from the last “C” or “D” level check. 


Conditional inspection history 


14.5.49 Because these inspections are only performed if the aircraft has experienced a special or unusual 
condition, it is important to search the records for the life of the aircraft for evidence of damage and repairs. 


Aircraft damage reports 

14.5.50 This might be the only place that will indicate if the aircraft was damaged e.g., service truck colliding with 
engine pylon while aircraft is parked at gate. Pay particular attention to the possible ground damage imposed upon the 
aircraft by servicing personnel. 


Contract maintenance before final flight 


14.5.51 Talk directly to the shop supervisor to determine if work was performed. The operator may not yet be 
aware of all contract actions prior to the aircraft's last flight. 
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Servicing 


14.5.52 Review servicing procedures, particularly fuelling and de-icing, accomplished prior to the aircraft's last 
flight. 


Major repairs and alterations 


14.5.53 Review the list of all Supplemental Type Certificate (STC) work that has been accomplished on the 
accident aircraft. In one case in which the aircraft experienced an in-flight loss of control, reviewing this list helped to 
determine that the accident aircraft was the only one in the operator's entire fleet with the newest thrust reverser 
modification. 


Powerplant data 


14.5.54 a) Engine condition monitoring data for the last 30 days. There may be a formal or informal programme 
or just untracked data recorded on the aircraft maintenance log. If you are provided raw data only, ask 
the operator if records can display the data in a graphic format. 


b) Engine change log. This log will show you which aircraft within the operator’s fleet the engines on the 
accident aircraft have been on in the past. If there is a questionable engine, you can review its 
maintenance history (by engine ATA code) for the period it was on another aircraft. 


c) Engine and airframe vibration monitoring data. 


14.5.55 Minimum equipment list. List of MEL items that were being carried on the accident aircraft. Determine from 
the master MEL the category (A, B, C, or D) of any carried items and whether any deferred items are past the allowable 
time limit. 


Airworthiness directive (AD) note list 


14.5.56 Review all ADs applicable to the accident aircraft. Confirm compliance date and methods. If there is a 
suspected problem with a component or system that has any ADs written against it, review a copy of the Engineering 
Order that was written by the operator to carry out the applicable portions of the AD. For those ADs which do not have or 
that have not had terminating action accomplished examine records of required repetitive actions 


14.5.57 Airworthiness Directive research is not easy. The investigator must be certain to search the aircraft, engine, 
propeller, and appliance indexes, published supplements and the ADs themselves. However, some ADs can hide from 
even the best index or search engine. For example, there is an appliance AD on paper air filters that applies to 
thousands of small aircraft. You can easily find this AD by performing a search for “paper filter’, but you would probably 
not think to do so. There is no substitute for experience and intuition when researching ADs. 


14.5.58 Many large aircraft have been operated in different states of registry. When researching ADs, search not 
only those ADs applicable to the current registry of the aircraft but also ADs which may have been applicable under 
previous registry. 


Certification Maintenance Requirements (CMR) 
14.5.59 Review the record of accomplishment. Assure that the CMR requirements were completed within the 


required time. Review the task cards associated with a CMR and any non-routine work that may have arisen from such 
CMR checks. 
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Service Difficulty Reports (SDR) 

14.5.60 Review for any suspect component reports. Be very specific and narrow the request as much as possible. 
There may be thousands of reports for a specific model of aircraft. Consider the limitations of SDRs previously 
discussed. 

14.5.61 Consider that many judge these data of little value because: 

a) they are virtually never the first source for identifying safety problems in transport aircraft; 

b) the data are of low quality and are inconsistent. They frequently lack key information; 

c) reporting requirements are too vague, leading to varying interpretations of what should be reported; 

d) aircraft manufacturers provide oral and written service advice on malfunction incidents, service 
problems, and potential solutions that are timelier than SDR data. Moreover, the quantity and variety 
of data provided to the aviation industry, by the manufacturers, not only match but far exceed those of 
the SDR programme. Additional types of data provided by the manufacturers include technical 
information on inspections, modifications and repairs, advice to customers of current events, and tips 
to simplify troubleshooting and maintenance; and 

e) caution must be applied to the interpretation of the data. It contains unverified information whose 
quality is highly dependent on the reporter’s knowledge, experience, and judgment. Be very specific 
and narrow this request as much as possible. There may be thousands of reports for a specific aircraft 
model. 

Service bulletins/etters, 

14.5.62 Search for titles that apply to the accident aircraft including suspect components. 

Record of cancellations, diversions, deviations 

14.5.63 Search for the accident aircraft (and all others of the same model) in the fleet for the last six months. If 
possible, have data listed separately for each maintenance base. This may indicate a trend. 


Part authentication 


14.5.64 Following the identification of a part as possibly having relevance to the probable cause of the accident it is 
necessary to authenticate its: 


a) airworthiness; 
b) correct installation; and 
c) maintenance history. 
14.5.65 There are numerous sources of parts that do not meet applicable requirements but enter the aviation 


system. All too frequently accidents have been attributed to improper parts or improperly installed parts that are either 
the root cause or contributory probable cause of the accident. 
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Airworthiness 


14.5.66 The concept of airworthiness of an aeronautical product is that the product conforms to an approved 
design and is in a condition for safe operation. In order for the product to continue to be airworthy, any replacement or 
modification parts installed must also conform to an approved design. 


14.5.67 The airworthiness of an aeronautical product containing unapproved parts is questionable because the 
part’s type design and quality are unknown. Positive identification of unapproved parts is often difficult, due to the 
similarity of unapproved part’s characteristics to those of approved parts. 


14.5.68 As a part of determining the airworthiness of a part it is necessary to establish its origins. The investigator 
should be familiar with Suspect Unapproved Parts programmes. 


14.5.69 Particular attention must be directed to determine that the part is not counterfeit. 


14.5.70 As you get into smaller general aviation aircraft the chain of evidence becomes less detailed. Sometimes 
the genesis of the part is obscure particularly with aircraft that have had many operators or owners and different 
registries. Particularly, changing the state of registry blurs the applicable airworthiness and maintenance rules which 
may apply. Suspect unapproved parts becomes an important issue. 


Unapproved parts 


14.5.71 Parts fall into two broad informal categories: approved and unapproved. Collectively, these parts are 
referred to as “unapproved parts” and, similarly, “approved parts” is the term for parts that do meet all applicable 
requirements. 


14.5.72 The commonly used term “approved part” is not synonymous with “a part that has received a formal 
regulatory approval.” The terms “approved parts” and “unapproved parts” as used here are not legal definitions, but 
simply a reflection of the need to have a broad term that identifies parts that should, or should not, be installed on an 
aircraft. Parts that can be used on an aircraft (i.e. “approved parts”) are described as parts “acceptable for installation” or 
“eligible for installation’. 


Counterfeit parts 


14.5.73 Counterfeit parts are a pernicious type of “unapproved part.” They are parts made or altered so as to 
imitate or resemble an “approved part” without authority or right, and with the intent to mislead or defraud by passing the 
imitation as original or genuine. They may be new parts that are deliberately misrepresented as designed and produced 
under an approved system or other acceptable method even though they were not so designed and produced. 


14.5.74 Counterfeit parts may also be used parts that, even though they were produced under an approved system, 
have reached a design life limit or have been damaged beyond possible repair for aviation standards, but are altered 
and deliberately misrepresented as acceptable, with the intent to mislead or defraud. 


Salvaged repairable parts 


14.5.75 It is quite common, when an aircraft is out of production and spare parts are not available, to acquire a part 
from a salvage yard. This is particularly true with structural replacement parts. Be suspicious of life-limited parts which 
have been salvaged. 


14.5.76 If a used part is thought to be worth saving for future use under controlled conditions it is salvageable. 
These parts should be documented and controlled so that they are not returned to service until they meet all 
airworthiness requirements. 
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14.5.77 If a used part is not thought to be worth saving, it is “scrap,” and should be disposed of in such a way that it 
cannot be returned to aviation service. However, both salvageable and scrap parts are sometimes misrepresented as 
having useful time left or as having been repaired in accordance with regulations. 


14.5.78 Other examples of parts that are not eligible for use are parts rejected during the production process 
because of defects, parts for which required documentation has been lost, parts that have been improperly maintained, 
and parts from military aircraft that have not been shown to comply with civil regulatory requirements. None of these 
should be installed in an aircraft. 


14.5.79 “Unapproved parts” also occur when a supplier that produces parts for an approved manufacturer ships 
directly to end users without the approved manufacturer’s authorization or a separate, applicable Parts Manufacturer 
Approval (PMA). An example of this is “production overrun” parts. Because these parts are not authorized by the 
Production Approval Holder (PAH), one cannot assume that they have met all the requirements of the approval holder's 
required quality control process; therefore, they are in contravention of the regulations and are not authorized for use on 
aeronautical products. 


14.5.80 It is evident that the concept of “unapproved part” is wide ranging, encompassing everything from parts 
that are improperly maintained, to parts produced under regulatory approval but shipped without proper documentation, 
to parts deliberately and criminally misrepresented as “approved parts.” 

Proof of authenticity or of past ownership 

14.5.81 In the case of Line Replaceable Units (LRUs) the genesis of the part may be traced by using the part’s 
airworthiness approval tags, serviceable tags and removal tags. Removal tags are those normally attached to removed 
LRUs that indicate its status as being airworthy, repairable, or condemned. 

14.5.82 If the accident aircraft, its components, engines or propellers were imported in the recent past, review all 
import process documentation and the actions taken qualifying the items to be in service. You may be required to 
contact and possibly interview the involved regulatory personnel who handled this process. It may be necessary to 
contact the regulatory office that provided oversight of foreign repair facilities used by the operator. 

14.5.83 Part identification and control procedures are covered in the operator’s general maintenance manual (GMM). 


Parts broker or dealers 


14.5.84 Parts brokers or dealers are not regulated. Often salvaged parts from other accident aircraft find their way 
into this supply chain. 


Borrowed 

14.5.85 Part borrowing is a common practice. Its use frequently requires specific approval from the regulatory 
agency. Determine that the operator and part lender are authorized to borrow parts. Consult both operators’ operations 
specifications. The general maintenance manual of the operators will contain the procedures for borrowing parts. 

Parts Manufacturing Authorization (PMA) 

14.5.86 If the part was produced under a PMA, determine the details of the PMA and its authenticity. 


Supplemental Type Certificate (STC) 


14.5.87 Determine details of an STC including its authenticity. Include a determination that the incident aircraft is a 
part of the STC and that the STC is valid in the state of registry of the incident aircraft. 
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Original Equipment Manufacturer (OEM) 


14.5.88 Was the part installed at the time of aircraft manufacture? This may be determined from the aircraft 
delivery records and provisioning records. 


14.5.89 With the passage of time, information may be obtained from the operator’s stores department records such 
as purchase order and/or receiving inspection records. 


14.5.90 When the aircraft involved is out of production, OEMs are a frequent source for structural “spares.” Often 
these structural parts are removed from retired aircraft and sold as is. The purchaser is required to establish 
airworthiness of these salvaged parts. 


In-house manufactured parts 

14.5.91 Parts not formally approved by regulatory agencies that are acceptable if used in the proper application are 
parts “fabricated” by maintenance personnel in the course of their repair work for the purpose of returning a product 
(aircraft, engine, or propeller) to service. Such parts are still required to meet applicable design criteria. Examples 


include sheet metal parts, tubing and cable assemblies, etc. 


Items resulting from AD note compliance 


14.5.92 A service bulletin attached to the AD will frequently call up a kit of parts or it may call for local manufacture 
of an item. 

Standard hardware 

14.5.93 Is the attaching hardware correct? It is not uncommon to use, consciously or unconsciously, hardware like 


nuts, bolts and other fasteners that do not conform to aeronautical standards. 


14.5.94 Manufacturers of products such as airframes and engines often specify that it is acceptable to use 
“standard parts,” such as nuts and bolts, for production and maintenance of those products. Standard parts production is 
not specifically monitored by the regulatory agencies, but must conform to specified industry-accepted criteria. Standard 
parts can be tested for conformity and may be used in aeronautical products only when specified in the type design. 


14.5.95 These include an established industry or acceptable international specification which contains performance 
criteria, test and acceptance criteria, and uniform identification requirements. The specification must include all 
information necessary to produce the part, and be published so that any party may manufacture the part. Examples 
include, but are not limited to, U.S. National Aerospace Standards (NAS), Army-Navy Aeronautical Standard (AN), and 
Society of Automotive Engineers (SAE). 


Lessors 


14.5.96 Increasingly many LRUs and type certificated items are leased to operators. The lease may include full 
maintenance support as provided by the lessor. 


Previous operator 
14.5.97 Previous owners or operators may have transferred their spares inventory to the new owner/operator. At 


the transfer to a new operating certificate the State of Registry may have been changed. Question whether the parts 
transferred meet the airworthiness requirements of the new State of Registry. 
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Correct installation 
14.5.98 Another contributory element to the accident is, all too frequently, the part’s incorrect installation. Was the 
suspect part correct for installation in the incident aircraft? Was the orientation of the part correct? 
Part history 
14.5.99 There may be several configurations of the part that are effective on specific aircraft or dependencies upon 
prior accomplishment of specific manufacturer's service bulletins. Is the installed software correct for the part as well as 
the aircraft? If the part in question was not the original installation what was the reason the part was installed on the 
incident aircraft? 

a) What is the Mean Time Between Unscheduled Removals (MTBUR) for the part? 

b) What is the fleet experience with the suspect part? 

c) What is the characteristic mode of failure? 

d) What are the maintenance processes for the part? 

e) Hard time, on condition, condition monitored? 


f) Is the part life limited? 


g) Have the time/cycle limits in the operator's maintenance programme escalated? Is the operator 
authorized escalation? 


14.6 GENERAL AVIATION AIRCRAFT INVESTIGATION 


General 
14.6.1 The spectrum of general aviation operations and equipment is wide. Vehicle types include ultralights, type 
certificated products including gas turbine or piston-powered fixed-wing airplanes, gliders and lighter-than-air machines. 
They include experimental vehicles such as home-built and restored military vehicles. They may be small experimental 


single engine aircraft to large transport category aircraft. 


14.6.2 Operations are conducted by hobbyists, individuals, non-air carrier corporate entities, VIP fleets, and 
fractional ownership organizations. 


14.6.3 General aviation is less rigorously regulated than air carriers. 


Investigation of general aviation accidents 


14.6.4 Frequently general aviation accidents are not team investigated. The entire investigation may involve one 
individual, with access to specialists as required. 
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14.6.5 Sometimes they are investigated by the technical regulatory agency of the country of occurrence rather 
than an independent governmental agency whose sole function is accident investigation. Investigations by these outside 
agencies are limited to the collection of data, facts and other evidence. This material at the completion of the 
investigative phase will be forwarded to the controlling investigative agency for analysis, determination of the probable 
cause and the publishing of the final accident report. 


General Aviation maintenance programmes 


14.6.6 Small aircraft maintenance is characterized by hard time processes whereas most air carrier maintenance 
is reliability centered. 


14.6.7 Minor repairs and alterations may be accomplished either by a repair station or by an appropriately 
certificated individual. The work done is normally entered into the aircraft log. If done by a repair station there will be a 
record of the work at the repair station as well as in the aircraft log. 


14.6.8 Major and minor repairs will involve a log entry as well as a formal report submitted to the responsible 
technical regulatory authority. 


14.6.9 Aircraft, engine and weight and balance logs can present as the only maintenance records. They are 
frequently carried on board the aircraft itself, admittedly a poor practice. Frequently, however, the operator of the aircraft 
will note any maintenance done while away from the home base and mail a record of it to the home base. 


Home-built aircraft 


14.6.10 In many States, the construction and maintenance of home-built aircraft provides for increased ability of 
the owner/operator to perform routine maintenance actions. At times, the certification of the aircraft as “Experimental” 
allows increased owner/operator access to maintenance. Investigators should determine if the owner/operator of these 
aircraft did not exceed the maintenance authorized under State certification authority. 


Investigative methodology 


14.6.11 In the case of small aircraft, the same methodology as for air carrier accidents apply. 


Publications 


14.6.12 Publications and maintenance records are less all-embracing. For example the flight operations, aircraft 
limitations, performance, weight and balance information is all contained in one document called the flight manual. There 
will usually be a maintenance manual (instructions for continuing airworthiness that will contain instructions for 
maintenance time limitations) and the illustrated parts document. 


14.6.13 Some aircraft may have little if any current technical data available. Typical examples are hobbyist 
constructed experimental aircraft and restored military aircraft. Aircraft may be out of production and the current type 
certificate holder has done little to track the aircraft in the type. One source of data is to contact the current type 
certificate holder, museum and original manufacturer's archives, and restoration groups. 
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Maintenance records 


14.6.14 In general aviation accidents in which extensive modifications to the aircraft have been accomplished, the 
investigative process is expanded. This expansion will include modification and engineering data relative to 
Supplemental Type Certificates (STC) and toward major repairs and alterations. 


14.6.15 There will be accidents in which maintenance records of the aircraft involved will be scanty. Quite often all 
the records of the aircraft are carried in the aircraft and may have been destroyed. This makes the task of the 
investigator more difficult. Nevertheless, a wealth of information may be obtained by the careful interviews of 
maintenance personnel and flight crew concerning work recently carried out on the aircraft and the other aspects which 
are covered during the normal maintenance investigation. 


14.6.16 Maintenance records are usually kept in separate log books. Aircraft log books (Airframe, Engine(s), 
Propeller(s)) will include total times and cycles. Inspection records may be kept in a different location. 


14.7, MAINTENANCE HUMAN FACTORS 


General 


14.7.1 The human factors portion of the maintenance investigation should be conducted in the same manner as 
that for the flight crew members involved in the accident. Lifestyle habits and working conditions can contribute to 
situations that lead to a mishap. Areas such as duty hours, shift-rotation policies, number of continuous workdays before 
the accident, etc., should be examined to determine if they did or did not contribute to or cause the accident. Operating 
pressures on limited resources should be examined in the same manner. 


14.7.2 Evaluate the work conditions for line and hangar maintenance personnel (day and night shifts). Take a look 
at lighting, temperature, ventilation, dryness, noise, hazards (e.g. weak or unstable work stands), size and roominess of 
work area, hazardous waste collection and disposal. Review assigned shift consistency, amount of overtime, and rest 
break adequacy. Interview workers. Get their opinion about relationships with supervisors, management, parent 
company, and unions. 


14.7.3 Obtain the workers’ opinions on the clarity of manuals, task cards, and oral instructions, especially to these 
materials related to work performed just prior to the accident. 


14.7.4 The investigator needs to consider in detail the following factors: 
a) The principles of human error; 
1) physiology; 
2) physical well being of individuals; 


3) communication processes used; 
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4) situational awareness; and 

5) the personalities of all parties to the incident; 
Rosters; 

1) shift cycles; 

2) rest periods provided and used; 

3) length of day and night shifts; and 

4) additional tasks imposed on the operator; 
Environment; 

1) operational; and 

2) domestic; 

Equipment and facilities; 

1) fitness for purpose; 

2) service history; and 

3) maintenance; 

Management aspects; 

1) organizational culture; 

2) management and labour union relationships; 
3) training programme; 

4) safety programmes and awareness; 

5) visible support; and 

6) operational feedback processes; and 


Standards and procedures; 


1) standard operating procedures documented and available to all individuals. 
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Chapter 15 


HELICOPTER INVESTIGATION 


Most investigation points discussed in the previous chapters of this manual apply 
equally to fixed wing and helicopter investigations and shall not be repeated in this 
chapter. This chapter will address those additional concerns unique to the 
investigation of helicopter occurrences and must, therefore, be read in conjunction 
with the investigative information contained in the rest of this manual. 


15.1 GENERAL 


15.1.1 For purposes of presenting unique helicopter technical components and the environment in which they 
operate, the descriptions in this chapter are based on a helicopter with a single main rotor turning in a counter-clockwise 
(CCW) direction when viewed from above. Where appropriate, reference is made to main rotors turning in a clockwise 
(CW) direction. 


15.1.2 Rotorcraft certification processes and requirements continue to evolve as the helicopter continues to 
evolve. The investigator needs to understand the applicable standards that were in existence when the helicopter was 
certified. 


15.1.3 Terms used by regulators, certifying authorities, manufacturers, operators and maintainers are usually not 
standard. For clarity, terms in wide use in the industry or used by the certifying authorities were used in this chapter. 


15.2 MODEL PECULIARITIES 


15.2.1 At the conceptual phase in the life of a helicopter, a decision is made to develop and produce a helicopter 
designed to meet operational performance and mission requirements. The preliminary design phase becomes an 
iterative process of sizing the helicopter, rotor and powerplant against the projected gross weight. For a given gross 
weight, the disk loading determines the rotor radius and the autorotation descent rate. The rotational speed of the rotor 
is determined by the aerodynamics of the rotor blade tip. A low tip speed means a greater angle of attack on the 
retreating blade while a high tip speed creates high Mach numbers on the advancing blade. Usually the smallest blade 
area that maintains an adequate stall margin is selected in the design process. The fuselage or main rotor size does not 
always indicate an important characteristic — the inertia of the rotor. Low inertia systems typically lose or gain rotor rpm 
easily and quickly during flight. High inertia systems lose and gain rotor rpm relatively slowly. A typical helicopter has an 
antitorque rotor producing thrust to oppose main torque and to prevent the helicopter from turning about its vertical axis 
in the opposite direction of the main rotor rotation. At the end of the day, the decision to produce a helicopter is a 
compromise of many aerodynamic, mechanical, structural, operational and economic parameters. 


15.2.2 The investigator should not make assumptions about the particular helicopter under investigation. Know 
how the controls work on the helicopter that was involved in the occurrence. For instance, in some helicopters as 
manufactured and in some operations, the pilot in command is seated on the left. In some cases, engine throttle on the 
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collective is rotated in a clockwise rotation to increase engine rpm. The investigator needs to sort out such peculiarities 
before proceeding with an examination of the control system. The investigator also needs to know the direction of 
rotation of the main rotor(s) and tail rotor; the direction of rotation of all drive shafts external to the engine and gearbox; 
and, in the case of multi-engine helicopters, how engine power is combined. Some rotorcraft have dynamic component 
vibration recorders to aid in maintenance analysis. These recordings may indicate potential dynamic component fatigue 
or failure. 


15.2.3 Category A helicopters are designed and built to higher standards than Category B. For instance, in the 
event of an engine fire, Category A helicopters must be controllable and continue flight for 15 minutes after a fire while 
Category B helicopters must be controllable for 5 minutes. 


15.2.4 As a good rule of thumb, any aerodynamic device added to the back end of a helicopter is there to resolve 
an aerodynamic or mechanical deficiency. 


15.3 TECHNICAL INVESTIGATIONS 


15.3.1 The principal structural elements of the helicopter subject to repeated loading and stress need to be 
inspected for integrity. These include rotor blades and attachment fittings; rotor heads including hubs, hinges and main 
rotor dampers; control system components such as control rods, servo structure and swashplates; rotor supporting 
structure; fuselage to include stabilizers and auxiliary surfaces; and main fixed or retractable landing gear and its 
fuselage attachment structure. 


Airframe 
Fuselage 


15.3.2 Fuselage damage and terrain scars may suggest the attitude of the aircraft at impact, and the relative 
magnitudes of the horizontal and vertical crash velocities. Indications of yaw rotation at impact may suggest a possible 
tail rotor failure. Note the fuselage crush line and whether the fuselage is metal or composite, or a combination of the 
two. Determine whether the rotorcraft provided “livable volume” as it relates to the ability of the airframe to maintain a 
protective shell around occupants. As a rough guide, metal structure rebounds by about 50 percent after impact. Note 
this in relation to occupant survivable space. Many models of helicopters are equipped with specially designed energy 
absorbing seats. Note the direction and degree of deformation to the seats, and the energy absorbing capability of the 
seat model. Deformation of the seat frame may cause the energy absorbers to receive unanticipated loads or cause 
excessive friction in the guides between the seat bucket and seat frame to lock the energy absorbers in place. In several 
accidents it was reported that clamps installed to hold wires for communication equipment blocked energy absorption 
features of the seats. 


Rotor strike 


15.3.3 Note any damage that may indicate a rotor has struck the fuselage. An inflight rotor strike to the fuselage 
generally suggests that contact was made as a result of mast bumping, rotor stall or excessive rotor flapping due to 
control manipulation from either rotor rpm too low or the aircraft encountered a reduced “g” manoeuvre. In the case of an 
in-flight break-up, losing even a relatively small part of a blade may cause such serious vibrations that the aircraft starts 
coming apart in the air. Note whether the cabin doors were removed or opened for flight or could have vibrated open 
during flight. This could increase the probability of cabin contents falling out and striking the rear rotor. Additionally, look 


for possible loose panels and cowling that could have initiated the accident sequence. 
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Chapter 15. Helicopter Investigation Ill-15-3 
Tail boom 
15.3.4 Note whether the tail boom has separated. Note the location of buckling and tears. Determine whether the 


tail boom came off primarily in bending or in torsion. Note any evidence of the main rotor striking the tail boom. Examine 
interior of tail boom for rub marks possibly caused by tail rotor drive shaft. Examine tail rotor drive shaft couplings and 
bearings for rotational deformation or fatigue. 


Stabilizer 


15.3.5 Most helicopters have a horizontal stabilizer mounted on the tail boom and some have a stabilizer mounted 
on the vertical fin. In some cases it is fixed, and in others it is connected to the flight controls and controlled by either the 
cyclic or collective and some are controlled automatically by speed sensing in the automatic flight control system (AFCS). 
The aerodynamic download on the tail boom caused by the horizontal stabilizer increases with forward airspeed. It is not 
unusual to see different rigging angles on the stabilizers due to the difference in airflow patterns on the sides of the tail 
boom. If the stabilizer becomes disconnected at high forward speed the download is immediately relieved. The resulting 
nose-down pitch of the helicopter, coupled with the pilot's instinctive aft cyclic input, can provide enough tilt to the main 
rotor so it strikes the tail boom. It is not uncommon to find the horizontal stabilizer itself severed spanwise by a main 
rotor blade strike. Determine the condition and position of the stabilizer and its controls. 


Expendable accessories 


15.3.6 Expendable accessories mounted on the outside of the fuselage and on the landing gear, such as cameras, 
loud speakers and search lights, should be mounted on frangible fittings and devices in order that their mass does not 
cause unacceptable damage to the rotorcraft structure and penetrate into the occupied areas or into the fuel tanks. 


External loads 


15.3.7 An external load is normally carried on a cargo hook that is located near the center of gravity (longitudinal, 
lateral and vertical). Look for evidence of load or sling contacting the aircraft. Note whether the aircraft was equipped 
with a doortop or belly hoist. Examine to ensure the external load release(s) system was functional and whether it was 
used. You might find that a load was being carried lashed to the fuselage or skids. 


Landing gear 


15.3.8 Most of the load is carried by the rear crossover tube of a skid-equipped helicopter. Similarly, the rear gear 
of a wheeled helicopter carries most of the load. If the aircraft is equipped with skids, note the type of skid. Some 
helicopters can optionally be equipped with taller skids (which, in turn, mean higher vertical CG), to help prevent tail rotor 
ground strikes, to help mount external equipment, or facilitate loading of passengers or cargo. Some types of skid gear 
are equipped with dampers so touchdown shocks or jolts are not transmitted to the main rotor system. Note skid 
deformation. Skids are designed to spread outwards to absorb energy. Soft ground or obstructions may prevent the 
skids from spreading. If the aircraft is equipped with a wheeled undercarriage, remember that under- or over-inflated 
tires and oleos may contribute to ground resonance. The translating tendency of the helicopter has a greater effect ona 
wheeled helicopter since one gear will touch down first; hence, wheeled gear should be locked before takeoff or landing. 
Note the presence and condition of landing gear accessories such as ground handling wheels, skis, tundra pads, or 
emergency floats. These may have contributed to the accident if they got snagged on the terrain or came loose in flight. 
If a water landing was involved, note the effectiveness of the emergency flotation gear. 


Miscellaneous 
15.3.9 Look for repainted surfaces, modified surfaces, loose hinge pins, loose balance weights and worn push- 


pull rods that may have caused flutter and excessive vibrations. Review maintenance repair records for damage or 
modifications. 
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Cable cutters 


15.3.10 If a wire strike was involved, determine if the helicopter was equipped with cable cutters and if they were 
effective. 


Main rotor system 


15.3.11 Main rotor systems are classified according to how the main rotor blades move relative to the main rotor 
hub. The three basic classifications are fully articulated, semirigid, or rigid. Some rotor systems use a combination of 
these types. The main rotor is attached to the mast assembly. Rotor heads are designed to meet particular weight 
reductions, complexity issues and to meet mission requirements such as folding blades. The different rotor heads may 
also be classified by the lubrication system used. The original rotor heads needed grease for lubrication of the bearing 
surfaces, requiring frequent maintenance to insure proper lubrication. The next improvement included an oil system in 
the head allowing the bearings to be enclosed in oil, needing less maintenance. The heads are now classified as wet or 
dry heads according to the lubrication requirements. Rotor heads are usually made of steel and aluminum alloy. Many 
parts are time-life limited because of stresses imposed on the head components. Some rotor hubs incorporate a flexible 
hub, which allows for blade bending (flexing) without the need for bearings or hinges. These systems, called flextures, 
are usually constructed from composite material. Elastomeric bearings may also be used in place of conventional roller 
bearings. Elastomeric bearings are constructed from a rubber-type material and have limited movement that is suited for 
helicopter applications. Flextures and elastomeric bearings require no lubrication and, therefore, require less 
maintenance. They also absorb vibration, which means less fatigue and longer service life for the helicopter components. 
A characteristic of rotor assembly elastomeric components is that they are sensitive to temperature change. Rotor 
systems such as Eurocopter’s Starfex, Sikorsky S-70 series or Bell's soft-in-plane, use composite material and 
elastomeric bearings to reduce complexity and maintenance and thereby increase reliability. 


Blade nomenclature 


15.3.12 Frequently, manufacturers identify the blades and their corresponding fittings by colour. For example, the 
blue blade is identified by a blue stripe as is its corresponding pitch change rods, dampers, hub lugs, etc. This 
convention facilitates reconstruction after an accident. 


Blade damage 


15.3.13 Note the direction in which the main rotor blades rotate. Rotor blade structure must have sufficient strength 
to withstand not only aerodynamic loads generated on the blade surface, but also inertial loads arising from centrifugal, 
Coriolis, gyroscopic and vibratory affects produced by blade movement. Reconstruct the blades and document the 
damage. Note failure locations and signs of paint or metal transfer suggesting blade may have struck something. If the 
blades are still attached to the hub and most of the damage to them is in the vertical direction, this may suggest a low 
main rotor rpm at impact. If the blades are fragmented and the fractures indicate failure in the direction of rotation, the 
blades may have failed at a high rotor rpm. Look for damage to the terrain that may suggest the blades were rotating at 
high rotor rom. Sometimes, the rotor hub continues to rotate allowing the blades to strike the terrain one by one and they 
may be found essentially stacked up. Main rotor blades striking water may bend up to the angle that the blades struck 
the water. Examine the blade-to-hub connection and the drag brace linkage. If the blades were being driven by the 
transmission, there may be significant damage in the drag plane, caused by the transmission continuing to force the 
blades around even after they had struck the ground. The opposing blade during a blade strike may exhibit damage to 
its drag brace linkage. In the case of autorotation, the drive force of the blades is coming from the blades themselves, 
not the hub, so the damage at the blade to hub joint will be different. Generally, under autorotation, the blade parts are 
found near the main wreckage. If a blade is found some distance from the wreckage, this may suggest an in-flight 
breakup. A jagged appearance of a blade fracture is typical of crash damage. A smooth fracture and a blade found some 
distance away might suggest a pre-crash failure. Losing part of a blade in flight may cause such severe vibrations that 
the aircraft breaks up in flight. Loss of a main rotor blade results in a totally unpredictable track of the remaining blades. 
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It is likely that the dynamic imbalance of the rotor system will result in divergent flapping of the remaining blades. A blade 
loss in one occurrence involving a multi-bladed rotor resulted in a complete stoppage of the remaining blades, with the 
helicopter rolling inverted because of the weight moment of the transmission. Loss of one blade in a two-blade system 
may result in loss of the transmission assembly. Some models of helicopters pressurize the interiors of the blade spars 
with inert gas to warn of cracks. Note whether this feature was provided and whether it was inspected prior to flight. 


Blade accessories 


15.3.14 Determine whether this model of aircraft has trim tabs on the blades. If so, note whether they are all 
present, and how they failed. Account for any balance weights in the blades. There may also be a metal end plate on the 
blade tip that may hold a tie-down ring or blade tracking device. Examine the damage to see if any of these items 
departed prior to the occurrence. There may be an abrasion strip on the blade’s leading edge. The result of leading edge 
abrasion strip failure/departure in flight may cause severe vibration. 


Rotor head 


15.3.15 The flight controls for the main rotor are normally attached to the main rotor drive shaft by sets of splines. 
Note damage to the swash plates, pitch change links, blade hinges, dampeners, and bearings, or their composite 
equivalents. Look for signs of pre-existing fatigue damage. Examine the stabilizer bar, if installed. Note damage to any 
stops that may suggest extreme blade motion in one particular direction. Some helicopters have control paddles 
attached to the rotor head which need to be examined. 


Swash plate assembly 


15.3.16 The purpose of the swash plate is to transmit control inputs from the collective and cyclic controls to the 
main rotor blades. It consists of two main parts: the stationary swash plate and the rotating swash plate. The rotating 
swash plate is connected to the pitch horns by the pitch links. 


Tail rotor system 


15.3.17 The tail rotor drive system consists of a tail rotor drive shaft powered by the main transmission and a tail rotor 
transmission mounted at the end of the tail boom. The drive shaft may consist of one long shaft or a series of shorter shafts 
connected at both ends with flexible couplings to allow the drive shaft to flex with the tail boom or, on small helicopters, it 
may be a drive belt. The tail rotor transmission provides a right angle drive for the tail rotor and may also include gearing to 
adjust the output to optimum tail rotor rom. The attachment structure must be designed to take inertia loads generated by 
angular and linear accelerations of the tail rotor and gearboxes encountered in flight or landing. Check the airframe 
mounting structure and attaching hardware. One rotorcraft design by Hughes Helicopter/McDonnell Douglas uses vectored 
airflow from the tail boom to replace the tail rotor. This has advantages in ground operations and confined area landings. 
The no-tail rotor, or NOTAR, has certain operational performance limitations. 


Direction of rotation 


15.3.18 Determine the direction of rotation of the tail rotor blade. The direction of rotation of the tail rotor varies 
between models. Generally, the advancing tail rotor blade moves in the direction opposite the flow of air from the main 
rotor blade to maximize the resultant flow of air across the tail rotor blade. However, in an effort to decrease noise and 
vibration, some helicopter tail rotor blades rotate so that the advancing tail rotor blade moves in the same direction as 
the flow of air from the main rotor blade. An issue with the tail rotor advancing with the flow of air from the main rotor 
blade is an inability to maintain sideward flight at moderate speeds on the side of the retreating main rotor blade. The 
direction of rotation of a fenestron, or ducted-fan, is also important and displays the same aerodynamic efficiency 
characteristics as seen in conventional tail rotors. (See Figure II|-15-1.) Ducted-fan tail rotors are in use by Eurocopter, 
Sikorsky and other manufacturers and also provide some safety benefits during loading with the rotors turning. 
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Figure Ill-15-1.  Fenestron 


Blade damage 


15.3.19 Document the damage to the tail rotor blades. Flat surface fractures may suggest a fatigue failure. Note 
any missing abrasion strips. Look for evidence that objects released from the cabin, external loads, or ground objects in 
the take-off or landing area may have contacted the tail rotor. Tail rotor strikes with water do not necessarily leave 
unique damage signatures. Evidence that suggests the tail rotor was not turning may suggest that the occurrence was 
caused by tail rotor drive shaft failure. 


Control mechanism 


15.3.20 Examine the tail rotor pitch change mechanism, bearings, and controls. A mechanical control failure, 
including objects in the cockpit that get behind the antitorque pedals, limits or prevents control of tail rotor thrust and is 
usually caused by a stuck or broken control rod or cable. Cell phones, personal digital assistants, knee pads, portable 
GPS units and such have the potential to jam antitorque controls. The amount of antitorque thrust generated depends on 
the position where the controls jam or fail. 


Tail rotor gearbox 


15.3.21 Note whether the tail rotor gearbox is still mounted to the tail boom. Vibrations resulting from a tail rotor 
blade imbalance may force the gearbox loose at its mounts. 


Separation of the tail rotor gearbox 


15.3.22 The typical tail rotor gearbox is bolted to the tail boom and has "ears" for the bolts. The structural failure of 
the ears or the loss of a single attaching bolt can lead to tail rotor gearbox separation. The long moment arm of the tail 
boom combined with the weight loss of the tail rotor gearbox and tail rotor assembly will result in a nose-down pitching 
moment because of the immediate shift in center of gravity. Should the pilot respond with a rapid aft cyclic input in an 
attempt to control the helicopter's attitude, a blade-to-tail boom strike is likely. 
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Antitorque pedal failure 


15.3.23 The tail rotor system may fail where a mechanical malfunction results in the pilot's inability to change or 
control tail rotor thrust even though the tail rotor may still be providing antitorque thrust. The investigator needs to 
understand the emergency procedures of the helicopter involved with the occurrence and what actions the crew may 
have taken and the results. Check the control for restrictions. 


Engine 


15.3.24 Gas turbines are used in most medium- to heavy-lift helicopters due to the large torque needed to meet 
operational requirements. A typical small helicopter has an aspirated reciprocating engine mainly due to the lower initial 
and recurring costs associated with reciprocating engines. Reciprocating engines generate higher torque oscillations 
than turbine engines. 


Correlator 


15.3.25 Sometimes called a synchronization unit, a synchronizer or anticipator, a correlator is cam-linkage 
connection between the collective lever and the engine throttle to coordinate the throttle with collective movement. 
Changing the pitch angle on the blades changes the angle of attack on each blade that results in a change in drag. In 
turn, the drag affects the speed or rpm of the main rotor. In order to maintain a constant main rotor rpm a proportionate 
change in power is required to compensate for the change in drag. This is accomplished with the correlator and/or 
governor that automatically adjusts engine power to meet the changing demands for engine power. 


Governor 


15.3.26 A governor senses rotor and engine rpm and makes the necessary adjustments in order to keep rotor rpm 
constant. In normal operations, once the rotor rpm is set, the governor keeps the rpm constant and there is no need to 
make any throttle adjustment. Governors are common on all turbine helicopters and used on some piston-powered 
helicopters. If the governor fails, any change in collective pitch requires manual adjustment to the throttle to maintain 
correct rpm. For high side governor failure, the engine and rotor rpm try to increase above the normal range. Low side 
governor failure, normal rom may not be attainable even if the throttle is manually controlled. 


Hydro-mechanical governors 


15.3.27 Hydro-mechanical governors are found in most civil and military single engine helicopters. The hydro- 
mechanical governor mechanically senses free turbine speed and combines it with bleed air from the compressor 
section to maintain the free turbine speed at a constant value. There may be stops built into the governor to prevent the 
power turbine from overspeeding and disintegrating. Additionally, the hydro-mechanical governor is a complex system of 
tubing, fittings, and mechanical levers with potential failure points. Failure modes include failure of the compressor 
pressure sensing subsystem resulting in the turbine speed decreasing to flight idle. 


Full Authority Digital Electronic Control (FADEC) 


15.3.28 There is no standard definition for FADEC; however, full authority generally means that the fuel control 
takes into account many variables compared with earlier hydro-mechanical controls that sensed few inputs to establish 
fuel flow to the engine. FADEC systems have been incorporated into both turbine and piston engines. Advancements in 
electronic fuel control have allowed the trend towards lower main rotor inertia and increases in turbine engine inertia. 
The move towards composite structures and electronic controls also increases consideration of lightning strike 
encounter effects. The electronics may cease proper operation while suffering no apparent component or device 
damage. Additionally, there may be effects from certified equipment such as antennas, radar, video and sound systems 
that are within 0.5 metres of the FADEC. 
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Engine power turbine 


15.3.29 Determine whether the engine power turbine has a free turbine to provide torque to the transmission or 
whether the turbine is connected directly to compressor and transmission by a common shaft. In the case of a sudden 
transmission stoppage, the free turbine arrangement has less inertia acting to twist the driveshaft to the transmission, so 
damage to that type shaft may be less pronounced. 


Engine mounts 


15.3.30 Examine damage to these mounts, sometimes called Lord Mounts, for evidence of pre-crash failures or 
sudden stoppage. 


Engine cooling fan 


15.3.31 Most reciprocating powered helicopters are equipped with an engine-cooling fan since they fly at speeds 
too low to permit adequate ram air-cooling. Some engine cooling fans are engine driven while others are transmission- 
driven. A cooling fan that shows signs of rotation at impact may indicate that either the engine or transmission was 
turning at impact. 


Chip detectors 


15.3.32 A helicopter sometines has many chip detector plugs for the engine(s) and gearboxes to detect 
ferromagnetic particles. Make sure to account for and examine all chip detectors. 


Engine air intake 


15.3.33 Examine the engine air intakes. Blockage could lead to an engine failure. Many helicopters have particle 
separators to protect the engine from sand and other debris ingestion. There have been cases of melted snow re- 
freezing in the intake resulting in engine failure. Additionally, extensive operations in hovering flight over salt water can 
cause extensive salt buildup on the rotor system and engine compressor section reducing engine and rotor performance. 


Transmission 


15.3.34 The primary purpose of the main rotor transmission is to reduce engine output rpm to optimum main rotor 
rpm. Transmission failure should be suspected when there is very little or no rotational damage to the main rotor blades 
and when there are high-impact forces. The transmission system transfers power from the engine to the main rotor, tail 
rotor, and other accessories (hydraulic system, electrical system, and rotor brake). The main components of a 
transmission system are the input drive assembly from the engine(s), main rotor drive output, tail rotor drive output, 
clutch, and freewheeling unit. Helicopter transmission systems are normally lubricated and cooled with their own oil 
supply. Some transmissions and associated gearboxes have chip detectors located in the sumps. In helicopters with 
horizontally mounted engines, another purpose of the main rotor transmission is to change the axis-of-rotation from the 
horizontal axis of the engine to the vertical axis of the rotor shaft. The failure of a main transmission is a single point 
failure and will have catastrophic results. As with other rotating components, lubrication by quantity and type is essential 
and must be checked. Beyond that, it may be necessary to forward the transmission for teardown analysis. In the past, 
transmissions have failed internally because of lack of lubrication and improper overhaul procedures. Developments in 
vibration control have led to rotor isolation wherein the fuselage is isolated from the rotor and transmission resulting in 
improved vibration and system reliability. Such developments have created other issues to include an effect on drive 
shaft critical speeds. 
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Transmission gear teeth 


15.3.35 Transmissions are generally very robust. Even in a severe impact, a transmission may break open 
exposing gears, but there may be little damage to gear teeth. Any damage to the gear teeth should be considered 
carefully since this often suggests they failed prior to the accident. Where there are gear- and shaft-driven accessories, 
i.e. generators and hydraulic pumps, inspect both gears and shafts. Although there are shear features built into these 
components, there have been instances of bearing failures in generators and hydraulic pumps and the shaft did not fail 
in shear resulting in main transmission failure. 


Transmission mount failures 


15.3.36 The main transmission on some helicopters is attached by means of a three-point mount. Each forward 
side mounts to a spindle that is bolted to a pylon support link and attached by clevis arrangements to the cabin roof. At 
the rear it is supported and attached by means of an elastomeric isolation mount that also dampens the pylon-to- 
fuselage vibrations and limits pylon rocking. Movement of the transmission and isolation mount is limited by a drag pin 
("spike") which extends downward into a plate in the transmission deck. Out-of-phase rocking between the transmission 
and the fuselage may result in contact between the drag pin and its static stop, a phenomenon known as "spike knock." 
This may lead to failure of the pylon support links in the vicinity of the pylon support bearing at the apex of the support 
link. When this has occurred in flight, the results have been catastrophic. On a helicopter with more rigid mounting, i.e. 4, 
5, or more mounts, the first indication to the pilot should be a lateral vibration. If allowed to continue to failure, there may 
be an indication or wrenching of the initially unfailed mounts, with the failed mount indicating little or no wrenching. 


Torque sensing and limiting system 


15.3.37 Some helicopters have a method of protecting the transmission from being overtorqued. Determine 
whether this system was functioning correctly, whether it may have been invoked, and whether it worked. This feature 
can sometimes lead to a situation where the main rotor rpm can decay if too much torque is demanded. 


Rotor rpm governor 


15.3.38 Determine whether there was a rotor rpm governor, and whether it was working. In some designs, the 
governor can be deliberately switched off to produce greater than the maximum allowable power. The analysis of 
instrument panel gauges and warning lights associated with rotor rpm may indicate whether a low rpm was involved in 
the crash. 


Rotor brake 


15.3.39 Some helicopters are equipped with a braking mechanism attached to the main rotor transmission to help 
slow the main rotor on shutdown. Rotor brakes have been unintentionally activated. This slowed down the main rpm toa 
point where flight could not be sustained. Inspect for an overheating condition; however, by their very nature, rotor 
brakes have some heat discolouration. 


Freewheeling unit 
15.3.40 Helicopters are equipped with a freewheeling, or overrunning clutch mechanism between the engine and 


first part of the rotor drive system to allow the main rotor to turn in autorotation without having to drive the failed engine. 
The freewheeling unit automatically disengages the engine from the main rotor when engine rpm is less than main rotor 
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rpm. These devices have sometimes been installed incorrectly, or failed when inadequately maintained. The 
freewheeling may slip causing the engine to speed up, since the transmission load is no longer demanding power from 
the engine, and the rotor rpm to drop. Often, the pilot must interpret the instruments and take corrective action. In some 
designs, this can lead to an automatic system shutting down the overspeeding engine. By leading to a combination of 
low rotor rpm and an engine shut down, a failed freewheeling clutch can result in an accident. There have been 
instances of freewheeling units failing to disengage the engine from the transmission thereby increasing the torque load 
in autorotation. This condition will not allow sufficient aerodynamic force in autorotation to maintain main rotor rpm for 
flight. Main rotor rom reduction can be caused by the added load of driving the lower rpm engine and this may cause 
individual free wheeling unit sprags to roll forward. In this case, there should be witness marks in the outer race of the 
freewheeling unit from the individual sprags to indicate they rolled forward during the sudden stoppage. Additionally, the 
output drive shaft coupling to the freewheeling unit has failed due to rocking of the transmission in reaction to 
aerodynamic and mechanical stresses. Check that it hasn’t failed in flight. 


Clutch 


15.3.41 Because of the greater weight of a rotor in relation to the power of the engine, as compared to the weight 
of a propeller and the power in an airplane, the rotor on a reciprocating powered helicopter, or a helicopter with a single 
spool turbine engine, must be disconnected from the engine when the starter is engaged. A clutch allows the engine to 
be started and then gradually pick up the load of the rotor. The two main types of clutches are the centrifugal clutch and 
the belt drive clutch. 


Drive train 


15.3.42 Drive train shafts are critical to flight items and should be accounted for and carefully examined. Determine 
the normal direction of rotation of each drive shaft. Drive shafts may exhibit torsional buckling and ultimate tensile failure. 
Drive shaft couplings are normally used to join drive shaft sections and continuity of the power train through these 
couplings should be established. Inflight shaft failures should be obvious. Fasteners and bolt holes in the flexible 
couplings (i.e. "thomas couplings”) should be inspected. Distortion of a thomas coupling is normally associated with 
impact damage. The absence of a bolt and a lack of distortion may indicate that the bolt was missing at impact. The 
driving end of the shaft will flail and damage the surrounding cowling and structure. Where drive shaft couplings are 
greased, look for the presence of heat and old grease particularly splattered on the surrounding structure. Heat does not 
have time to build up in a crash sequence and grease splattering may indicate bearing problems. Old grease may be 
indicative of a seal failure. Drive shafts have splined couplings and/or flex couplings to maintain continuity of the power 
train during pylon and tail boom movement in flight. 


Failed or twisted shafts 


15.3.43 Determine the normal direction of rotation of all drive shafts external to the engine and gearbox(s). Note 
the direction of each drive shaft’s failure or deformation to determine direction of the torque on these shafts at the time 
they failed or deformed. Twisting a soft tubing or small piece of multicoloured plastic straw is helpful in visualizing the 
direction of applied torque necessary to cause a particular direction of shaft twist. Use this information to logically reason 
whether the engine was driving the transmission and whether the transmission was driving the rotor at the time of impact. 
This may suggest whether the rotor was engine driven or under autorotation. For example, in the Bell 206, the short 
shaft between the engine and main transmission will only show torsional deformation if the engine was powering the 
main transmission, and not if the helicopter was in autorotation. Similarly, a main mast will generally only twist if it was 
driven by the transmission. In the case of a multi-engine helicopter, consider how the engine power is combined and 
how the failure of a single engine redistributes shaft torques. 
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Engine to transmission drive shaft assembly 


15.3.44 The main drive shaft(s) transmit power from the engine(s) to the transmission. The shaft may go directly 
into the transmission from the engine, as in a single-engine and some multiengine helicopters, or they may go through 
intermediate gearing, as in a combining gearbox or speed decreasing gearbox, before connection to the main 
transmission. In the event of a failure or malfunction of a main drive shaft, the first indication may be a low rpm warning. 
The warning can be misinterpreted as an engine-out condition. Another indication could be a loud noise or bang when 
the output shaft from the engine disconnects. Engine rpm is generally taken at a point before the engine output shaft. 
Items to be examined in a mishap where main drive shaft failure is suspected include lubricants, bearings, and gears. If 
a clutch is part of the power train and internal to a combining transmission, it too should be examined. Splined couplings 
and flex couplings are intended to permit pylon and shaft movement while maintaining continuity of the power through 
the main drive shaft. 


Main rotor drive shaft 


15.3.45 The main rotor drive shaft is part of the mast assembly and is the heavy tube providing torque from the 
transmission to the main rotor. This tube is subject to high torsion and tension loads and bending moments. The mast 
supports the weight of the helicopter and also drives the rotating swashplate through which the main rotor flight controls 
operate. In some helicopters the mast is a hollow, stationary tube with a driveshaft passing through its centre to provide 
torque to the main rotor. Examine the mast for continuity and damage to attached control-related accessories. A bend in 
the shaft may indicate which blade struck a solid object first. Check the condition of stops. Masts have failed in flight due 
to mast bumping on teetering rotors and due to improper manufacturing, installation, maintenance and overhaul 
procedures. A failure of a main mast bearing may result in the shearing of the mast or stoppage of the main rotor. If the 
mast has separated, examine the fracture surface for fatigue damage. More commonly the mast fails in overload. In the 
case of an aircraft with a teetering rotor, an ovalized cross-section shape, where the damage corresponds to where the 
rotor would have struck the mast, suggests mast bumping. If the blades have made such extreme motions, it is also 
likely that they have cut through the fuselage. 


Tail rotor driveshaft 


15.3.46 Examine the tail rotor driveshaft for direction of failure. Torsional deformation of this shaft may suggest that 
the tail rotor was turning at the time of the occurrence. The direction of the torsional deformation may suggest whether 
the main transmission stopped suddenly as the main transmission continued to turn. Examine the tail rotor driveshaft 
couplings and hanger bearings for failure and heat discolouration on greasable fittings. Look for indications that the 
hanger bearing seals failed. Look for potential entanglement between the driveshaft and control cables. If the driveshaft 
becomes loose in flight, it may damage the inside of the tail boom. 


Bearings and couplings 
15.3.47 Examine all bearings and couplings in the drive train for failure, inadequately tightened bolts, overheat, or 


sign of lack of lubrication. Some manufacturers paint critical couplings with temperature-sensitive paint or attach heat 
indicator labels to identify overheating. Note the integrity of flexible couplings and determine their failure mode. 
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Systems 
Hydraulic control servos 


15.3.48 Most helicopters, other than small helicopters, incorporate the use of hydraulic actuators to overcome high 
control forces. A typical hydraulic system consists of actuators (also called servos) on each flight control, a pump that is 
usually driven by the main rotor gearbox, and a reservoir to store the hydraulic fluid. If a helicopter is fitted with only one 
hydraulic system, then the helicopter must be controllable without the system. In those helicopters where the control 
forces are so high that they cannot be moved without hydraulic assistance, two or more independent hydraulic systems 
may be installed. Some helicopters use hydraulic accumulators to store pressure, which can be used for a short period 
of time in an emergency to land if the hydraulic pump fails. Failure of the hydraulic boost may make the helicopter more 
difficult to control and in some helicopters, hydraulic failure may lead to complete loss of control. Stresses imposed by 
flight loads and the stresses imposed by the hydraulic pump pressure pulses have resulted in ruptured lines, pump 
failure, regulator failure, ruptured seals, and broken output links. Before moving anything, note the positions of all 
hydraulic servos. Check fluid levels and fluid type for contamination. Check filter screens and bypass switches. An 
impending hydraulic failure may be indicated by a grinding, ratching, or howling noise from the pump or actuators; 
increased control forces and feedback; and limited control movement. In the event of a hydraulic failure expect that the 
crew may have deactivated the hydraulic system to avoid unexpected restoration of hydraulic power in a critical phase of 
flight. However, consideration should be made that the crew intentionally or unintentionally disengaged the hydraulic 
system, initiating the accident sequence. 


a) Servo actuator hardover. Servo actuator hardovers are related to an automatic flight control system 
input or to the pilot inadvertently engaging the system into a hardover condition. This may result in one 
servo driving to a limit or binding, causing adverse handling characteristics. This may be overcome by 
switching servo control systems or securing servo assistance. 


b) Control failures at or below the hydraulic servos. This type of failure occurs in the lower part of the 
flight controls and can be caused by disconnect or rupture of control linkages, such as: push-pull or 
torque tubes, bellcranks and walking beams, or rod end bearings. Failures of this type have occurred 
after nuts have backed off connecting bolts, either when self-locking nuts were improperly installed or 
reused, or when cotter keys were omitted from castellated nuts. Servo malfunction can occur because 
of an internal failure such as with a broken internal component or contamination of hydraulic fluid. If 
the servo malfunction is such that control from the cockpit is lost, uncontrolled excursions of the rotor 
disk are probable. 


c) Control failures above the hydraulic servos. The flight controls above the servos are subject to greater 
aerodynamic loads than those below the servos, which act to dampen the loads on the lower controls. 
Failure of the flight controls above the hydraulic servos results in an uncontrollable rotor disk. Failures 
have occurred because of improperly manufactured, installed, or maintained components, and loss of 
fasteners. Overtorquing has caused failures at the pitch change link clevis bolts at the spherical 
bearing on the outer (rotating) swashplate or at the pitch change horns at the rotor head. Failures 
have occurred on the trunions of both the rotating and nonrotating swashplates. 


d) Servo transparency. Servo transparency begins when the aerodynamic forces exceed the hydraulic 
forces and is then transmitted back to the pilot’s cyclic and collective controls. The maximum force that 
the servo actuators can produce is constant and is a function of hydraulic pressure and servo 
characteristics. The system is designed to exceed the requirements of the flight limitations in the 
approved flight manual. With excessive manoeuvring and under a combination of high airspeed, high 


collective pitch, high gross weight, high “g” loads, and high density altitude, the aerodynamic forces 
can increase beyond the opposing hydraulic servo forces and servo transparency can occur. An 
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improperly serviced/maintained hydraulic system can also effect the onset of servo transparency. On 
CCW turning main rotor systems, the left servo receives the highest load when manoeuvring, so servo 
transparency results in uncommanded left and aft cyclic motion accompanied by down collective 
movement. The pilot’s control force to counter this aerodynamically-induced phenomenon is relatively 
high and could give an unaware pilot the impression that the controls are jammed. If the pilot does not 
reduce the manoeuvre, the aircraft rolls right and pitches up. 


Fuel systems 


15.3.49 The fuel system is made up of two groups of components: the fuel supply system and the engine fuel 
control system. Fuel tanks are usually mounted to the airframe as close as practical to the center of gravity. This way, as 
fuel is burned off, there is a negligible effect on the center of gravity. A drain valve located on the bottom of the fuel tank 
allows the pilot to drain water and sediment that may have collected in the tank. A fuel vent prevents the formation of a 
vacuum in the tank, and an overflow drain allows for fuel to expand without rupturing the tank. A fuel quantity gauge 
located on the pilot's instrument panel shows the amount of fuel measured by a sensing unit inside the tank. Some 
gauges show tank capacity in both gallons and pounds and some gauges indicate percentage of fuel remaining. A shut- 
off valve provides a means to completely stop fuel flow to the engine in the event of an emergency or fire. Most non- 
gravity feed fuel systems contain both an electric pump and a mechanical engine driven pump. The electrical pump is 
used to maintain positive fuel pressure to the engine pump and also serves as a backup in the event of mechanical 
pump failure. A fuel filter removes moisture and other sediment from the fuel before it reaches the engine. A safety 
feature found more commonly on helicopters than fixed wing aircraft is breakaway fuel fittings. Note the presence and 
effectiveness of such fittings. For extended operations, some rotorcraft may also carry extended range tanks in the cabin. 
These should be inspected for security as well as operating functions. 


Autopilot and stability augmentation systems 


15.3.50 Some helicopters incorporate stability augmentation systems (SAS) to aid in stabilizing the helicopter by 
damping the pitch and roll motions caused by gusts, and in some designs the minimization of pilot induced oscillations. 
The earliest SAS systems incorporated mechanical devices found in the rotor heads such as the stabilizer bar. Another 
early electro-mechanical SAS device is the force trim system that uses a magnetic clutch and springs to hold the cyclic 
control in the position where it was released. Gyros are used to generate electrical signals to drive hydraulic servos or 
electrical actuators to tilt the swashplate to resist the helicopter’s motion. The system is designed to distinguish between 
pilot inputs and gust induced motion. A similar system may also be installed in the tail rotor control system to improved 
directional stability and control characteristics. In addition to the SAS, IFR equipped helicopters are generally all 
provided with an autopilot. The most common functions are altitude and heading hold. Some more advanced systems 
include vertical speed or indicated airspeed (IAS) hold mode, where a constant rate of climb/descent or indicated 
airspeed is maintained by the autopilot. Some are tied into radio navigation and landing equipment to operate flight 
director displays. Some can fly instrument approaches to a hover and takeoff/go-around. SAS is especially useful for 
hovering flight such as over-water rescue or power-line inspection and repairs. 


Environmental systems 


15.3.51 The simplest form of cooling is ram air-cooling. Air ducts in the front or sides of the helicopter are opened 
or closed to let ram air into the cabin. Piston powered helicopters use a heat exchanger shroud around the exhaust 
manifold to provide cabin heat. Turbine helicopters use a bleed air system for heat. Large helicopters may also use a 
small gas heater. Some commercial helicopters also use air conditioning units for warmer climates. 
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Anti-icing systems 


15.3.52 Most anti-icing equipment installed on small helicopters is limited to engine intake anti-ice and pitot heat 
systems. Larger helicopters may have systems for airframe and rotor anti-icing, but it is not common due to the 
complexity, expense, and weight of such systems. If the leading edge of a rotor is electrically heated to prevent ice 
formation, expect that an AC generator is supplying the power. AC generators run at a fixed speed and, due to 
autorotational performance requirements, are normally driven by the transmission. 


15.4 OPERATIONAL INVESTIGATION 


15.4.1 The investigator needs to consider the helicopter’s operating environment. Helicopters originally designed 
and manufactured for a particular type of operation might be in use for a different operation and may incur stresses that 
were never considered when it was initially certified. Helicopter logging can induce premature fatigue failure in the 
structural and dynamic components due to the frequent heavy loading/lift cycles. Operating near salt water can result in 
premature corrosion. Continuous use of high power settings may cut short expected engine life. Remote operations may 
encourage unacceptable operational and maintenance practices. 


15.4.2 Most dynamic rotorcraft components have periodic inspections and service life limitations. However, under 
the original design specifications, other dynamic or structural components may not have required inspections because 
their design life exceeded the anticipated airframe life. Therefore, as a result of airframe service life extensions and 
remanufacturing programmes, components that did not have an inspection cycle or service life limit may now experience 
fatigue failures. 


Landing/takeoff area 


15.4.3 The investigator needs to consider the effects of the characteristics of the take-off and landing area. 
Characteristics include obstacles in the flight path, slope of the area, effect of wind to include relationship of the wind to 
the surrounding terrain, direction of flight, obstructions to visibility, effects of vegetation along the flight path, density 
altitude, illumination of the area, and visual distractions. If take-off is into a strong crosswind or tail wind, the use of more 
tail rotor thrust to maintain direction control absorbs power from the engine, which means less power available to the 
main rotor for the production of lift. Additionally, the investigator needs to consider how effectively the pilot could see the 
characteristics and obstructions of the area. Further, should the accident occur during hours of darkness, consider the 
effect of available lighting and marking of obstructions. 


15.4.4 Generally, gross weight, altitude and ambient temperature affect takeoff, landing and hover performance. 
Manufacturer’s data for takeoff and landing performance provided in the rotorcraft flight manual are corrected to smooth, 
dry, hard, level surface conditions. Landing distance for performance data purposes is measured from a point where the 
lowest part of the helicopter is 50 feet (25 feet for VTOL) above the landing surface to the foremost part of the helicopter 
after coming to a stop. 


15.4.5 Normally, helicopters require capability to hover for both takeoff and landing. Takeoff phases to consider 
are lift-off to a hover, acceleration from the hover through effective translational lift (approximately 30 knots), and 
establishing a climb out. Similarly, landing phases to consider are descent, approach to a hover while decelerating below 
effective translational lift, and landing from a hover. 
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15.4.6 Prepared areas such as helipads and runways should be adequately marked and lighted. Elevated 
helipads on platforms or on top of buildings may present obstacles to the flight path and obstacles that may affect the 
helicopters ability to hover in ground effect. Helipads on buildings and oilrigs may require that the helicopter operate 
within the avoid areas of the height-velocity diagram during takeoffs and landings. Additionally, such operations may 
also limit the gross weight of the helicopter compared with operations from ground level. 


15.4.7 Unprepared areas may present their own challenges to helicopter operations. Inadequate procedures used 
during takeoff and landing may create restrictions to visibility due to rotor wash effect on snow, dirt or sand. Accidents 
have happened when the pilot misread available wind indications. Rather than make normal approaches into the wind to 
pinnacles or ridgelines the pilot should be making steeper approaches into greater winds to avoid turbulent air and 
downdrafts. In an unprepared area, consider the possibility that the helicopter landing gear snagged or struck terrain 
features such as rocks, dirt mounds or thick vegetation, initiating the accident sequence. Common errors in remote 
operations are improper reconnaissance procedures, failure to consider performance data, and failure to avoid 
prohibited areas of the height-velocity diagram. 


Carburetor icing 


15.4.8 Carburetor icing is considerably more critical for helicopter reciprocating engines than for fixed wing. In 
fixed wing aircraft, the propeller will act as a flywheel and, in effect, assist in keeping the engine running, although 
roughly. The rough running engine will cue the pilot to activate carburetor heat and, if timely action is taken, avert a 
complete engine failure. For helicopter operations, the flywheel effect of the propeller is not present and the pilot may not 
receive similar rough running engine warnings about an impending engine failure. When the pilot becomes aware of a 
power loss due to carburetor icing, it may be too late for an effective reaction. Atmospheric moisture even in clean air 
and temperatures above freezing can result in ice accumulation in the induction system to a degree that can easily 
cause engine failure. Evidence of carburetor icing is very difficult to detect because the ambient heat in the engine will 
likely result in the melting of any ice formed in the carburetor. The investigator's only recourse may be to reconstruct the 
atmospheric conditions present at the altitude at which the helicopter was operating. 


Impact ice 


15.4.9 Impact ice forms as supercooled water droplets impacted on engine induction system components. 
Particularly heavy accumulations can be expected where bends or turns in the induction system force changes in the 
airflow direction. 


Throttle ice 


15.4.10 Throttle ice forms at or near the throttle in a partly closed position with a lowering of the air temperature 
due to the cooling effect that results from an increase in the velocity and increase in kinetic energy of the air in the 
restricted flow area. 


Refrigeration ice 


15.4.11 The refrigeration phenomenon is the most serious of all factors causing carburetor ice in helicopters. The 
effect of fuel vaporization after the fuel is introduced in the air stream and decreasing air pressure in the venturi causes a 
sharp drop in temperature in the carburetor. Should the temperature within the carburetor decrease to freezing or below 
freezing, carburetor ice may form on internal surfaces, including the throttle valve. Refrigeration ice can affect airflow by 
blocking the throat of the manifold riser; it can affect the fuel-air ratio by interfering with the fuel flow; and it can affect 
mixture distribution or quantity of mixture flowing to individual cylinders by upsetting the fuel flow distribution. It is 
possible to accumulate refrigeration ice during a closed throttle descent or autorotation with ambient air temperatures as 
high as 93°F/34°C and relative humidity as low as 30 per cent. At low cruise power, refrigeration ice can occur at outside 
air temperatures as high as 62°F/17°C and relative humidity at 60 per cent or greater. 
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Miscellaneous 


15.4.12 Some normally aspirated piston engines incorporate automatic carburetor heat when the collective lever is 
below a certain setting. Other manufacturers recommend leaving carburetor heat on for the duration of the flight. 


15.4.13 There is less danger of carburetor icing with a fuel injected engine that injects fuel directly into the intake 
manifold. 


Autorotation 


15.4.14 Autorotation is permitted mechanically because of a freewheeling unit that allows the main rotor to 
continue turning even if the engine is not running. The freewheeling unit is normally considered part of the transmission. 
In an autorotation, the main rotor blades are driven solely by the movement of air up through the rotor disc. The rate of 
descent airflow in an autorotation is determined mainly by forward airspeed. The most common reason for an 
autorotation is an engine failure, but autorotations may also be entered in the event of other aircraft emergencies such 
as tail rotor failure or recovery from settling with power. In the event of sudden engine stoppage, pilot reaction time is a 
significant factor in that the pilot must react quickly to prevent the rapid decay of main rotor rpm. In the event of engine 
failure, the timely lowering of the collective will enable the pilot to maintain rotor rpm. 


15.4.15 Because the relative wind on rotor blades in autorotation shifts from a high angle of attack inboard to a 
lower angle of attack outboard, the lift generated has a higher forward component closer to the hub and a higher vertical 
component toward the blade tips. This creates distinct regions of the rotor disc that create the forces necessary for flight 
in autorotation. The autorotative region, or driving region, creates a total aerodynamic force with a forward component 
that exceeds all rearward drag forces and keeps the blades spinning. The propeller region, or driven region, generates a 
total aerodynamic force with a higher vertical component. Near the center of the rotor disc is a stall region where the 
rotational component of the relative wind is so low that the resulting angle of attack is beyond the stall limit of the airfoil. 
The stall region creates drag against the direction of rotation that must be overcome by the forward acting forces 
generated by the driving region. 


15.4.16 Disregarding the effect of rotor inertia, the rate at which the main rotor decreases rpm when the engine 
fails is influenced by flight conditions requiring a high collective setting such as: slow airspeed, especially at high power 
settings required in a hover; high speed; high altitude or high density altitude; steep, full-power climb; steep angle of 
bank; and carriage of external loads. In the event that the collective lever is not lowered, the rotor will begin to feed on its 
own energy by slowing down to make up for the power loss. If the collective lever is still not lowered, the rapid loss of 
main rotor rpm decreases the centrifugal force and permits the rotor to cone excessively to the point where recovery of 
main rotor rpm is not possible. 


15.4.17 At sudden stoppage of the engine, low inertia main rotors rapidly decrease rpm thereby decreasing pilot 
reaction time, compared with high inertia rotors that give the pilot more time to take appropriate action to establish 
autorotation. The advantage with low inertia rotors in autorotation is that rotor rom can be quickly regained compared 
with high inertia rotors. 


15.4.18 Several factors affect the rate of descent in autorotation; altitude, gross weight, rotor rpm and airspeed. 
The power required to turn the main transmission, tail rotor transmission, tail rotor and accessories driven by the 
transmission also add to the greater descent rate of a helicopter in autorotation. Primary control of the rate of descent is 
airspeed. Higher or lower airspeeds are obtained with cyclic pitch control just as in normal flight. Airspeed for 
autorotations is established for each type of helicopter on the basis of average weather and wind conditions and normal 
loading. Main rotor rpm increases with gross weight and density altitude and is controlled with collective pitch. 
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15.4.19 The last 100 to 75 feet are critical, since there must be a smooth transition from autorotation descent to a 
power-off landing. During this phase, the air flow through the rotor system is reversed and the stored momentum of the 
rotors is exchanged for reduced forward and vertical speed. Various helicopters require different cyclic and collective 
technique for establishing the flare; however, should the airspeed slow below 45 to 40 knots, the flare may be ineffective 
in decreasing the rate of descent. Deceleration must be continued through the flare so that the rate of descent and the 
forward speed are reduced just before touchdown to the slowest rates possible for the existing conditions. 


15.4.20 Depending on the surface characteristics, the helicopter may enter into sudden deceleration after 
touchdown. Lowering the collective immediately after touchdown may cause the undercarriage to dig in and the 
helicopter to nose over. 


15.4.21 During practice autorotations with recovery at a hover, the throttle needs to be fully open before the 
collective lever is raised; otherwise, in many helicopters, the engine coming on-line may cause torque handling problems. 


Main rotor inertia 


15.4.22 By adding mass to a rotor blade, centrifugal force increases providing beneficial results such as lowering 
the coning angle. This technique is used in some high inertia blades when a few ounces of lead are placed inside, or 
near, the blade tips where angular momentum is greatest. 


15.4.23 High inertia rotor systems with higher angular momentum rotor rpm tend to fluctuate rpm less; at normal 
operating rpm, due to smaller coning angles, maintaining rotor rpm requires less power; entering an autorotation is 
easier; and executing a landing flare from an autorotation is easier. High inertia rotor systems lose and gain rotor rpm 
slowly compared with low inertia rotor systems. Because of the higher angular momentum and accompanying centrifugal 
force on the high inertia rotor system, the rotor head and transmission need to be more robust than a low inertia rotor 
system. The blades also need to be built stronger as each blade section carries a higher centrifugal force along the span 
of the blade. Hence, a high inertia rotor means more basic weight. High inertia rotor systems can be more dangerous 
should main rotor rpm decay, particularly at low altitude, as it takes longer to accelerate back to a safe rotor rpm. An 
underpowered helicopter with little or no margin between power required and power available operating with a high 
inertia rotor system is especially susceptible to an accident since little or no power margin is available to regain safe 
main rotor rpm in a timely manner. 


15.4.24 Low-inertia rotors with lower angular momentum lose and gain rotor rpm quickly and easily with variances 
of engine-provided torque, collective pitch demands on the rotor system and external factors such as wind gusts. Low 
inertia rotors provide for minimum blade and hub weight, hence, lower costs. Similar to high inertia rotor systems, an 
underpowered low inertia rotor system may not have power available to accelerate the main rotor back to a safe rpm. 
Low-inertia rotors have faster disc attitude control and are more manoeuvrable compared with high-inertia rotors. 
Advances in electronic engine controls and composite materials have advanced the safety and reliability of low inertia 
rotors. 


15.4.25 Given an altitude, rotor inertia is a major factor in determining the size and shape of the height-velocity 
diagram. Typically, the takeoff corridor of a low inertia rotor system continues to the minimum power climb speed (Vy), 
approximately 45 to 50 knots, before climb begins. For a high inertia rotor, typically the climb begins after effective 
translational lift (ETL), approximately 15 to 20 knots. Typically, the avoid (shaded) area of the cruise portion of the 
diagram for low inertia rotors includes a much higher envelope than for high inertia rotors. 


15.4.26 Fuselage or rotor size does not always indicate rotor inertia. With a low inertia rotor, main rotor rom decays 
rapidly when the last engine is made inoperative. Additionally, due to this relatively low inertia level, considerable 
collective may be needed to prevent rotor overspeed conditions when the rotorcraft is flared for autorotative landing, 
particularly near maximum gross weights and at high altitudes. 
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Dynamic rollover 


15.4.27 Dynamic rollover is the occurrence of a rolling motion introduced by a lateral component of main rotor 
thrust. When the helicopter touches the surface with one side of the landing gear, the aircraft may begin rolling and may 
get to the point where it cannot be controlled. During normal or slope takeoffs and landings while any part of the landing 
gear, skid or wheel, is acting as a pivot, a moment is produced by the lateral component of the main rotor thrust about 
the point of surface contact. Normally, the rolling moment is opposed by the position of the weight of the aircraft between 
the wheels or skids. The opposing moment to the rolling motion decreases as the aircraft rolls to progressively steeper 
bank angles while maintaining contact with the surface. The helicopter will reach a bank angle beyond which it is 
impossible to stop further rolling motion. If the helicopter remains in contact with the surface, it will roll over onto its side. 
The angle beyond which this is likely to happen is called the critical roll angle. The rate at which the initial rolling motion 
takes place significantly influences the critical roll angle. (See Figure III-15-2.) 


15.4.28 The main causes of dynamic rollover are an inappropriate control input and a failure to take timely action to 
correct the situation. A pilot’s improper lateral cyclic movement or aircraft lateral drift results in a lateral thrust vector 
when the main rotor thrust is approximately equal to the weight of the aircraft. That sideward component of thrust tends 
to move the helicopter laterally or roll the helicopter about a pivot point. The pivot point necessary for dynamic rollover is 
lower than the helicopter’s vertical center of gravity and is normally the lowest part of the helicopter, the landing gear. 
The rolling motion can occur on initial takeoff with excessive lateral cyclic trim due to a change in weight and loading of 
the helicopter. It may also occur when the landing gear is restrained from moving such as when stuck in mud, ice, or soft 
asphalt; failure to remove a tie-down; or when the helicopter is moving sideward in a hover and strikes the surface or an 
object. The dynamic rollover sequence can take as little as two seconds from initiation of the roll to rotor blades striking 
the surface. 
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Figure Ill-15-2._ Dynamic rollover conditions 
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15.4.29 Dynamic rollover occurs on unimproved sloping terrain as well as improved flat surfaces. Physical factors 
that contribute to dynamic rollover are the rate of rolling motion, lateral center of gravity, high gross weights, tail rotor 
thrust, crosswinds, tail winds, ground surface, slopes and main rotor design. Flight operations on a ship or floating 
platform, particularly if the landing area is rolling during landing or takeoff, may contribute to a dynamic rollover. A loss of 
visual reference due to obstructions to visibility, darkness, dust and snow have contributed to dynamic rollover 
occurrences. 


Lateral centre of gravity 


15.4.30 As passengers, crew members or cargo are loaded or unloaded, or as crew members move about the 
cabin, lateral cyclic requirements change. If the helicopter utilizes interconnecting fuel lines that allow fuel to 
automatically transfer from one side of the helicopter to the other, the gravitational flow of fuel to the downslope tank 
could significantly alter the center of gravity. With asymmetric loading, the helicopter is more likely to roll towards the 
heavier side. 


Tail rotor thrust 


15.4.31 Translating tendency and rotational moment generated by the tail rotor contribute to a helicopter’s 
tendency to enter a dynamic rollover in the direction of antitorque thrust. During hovering flight, a single main rotor 
helicopter tends to drift in the same direction as antitorque rotor thrust. The drifting motion is called translating tendency. 
Since tail rotors are normally located above the centre of gravity in a hover, tail rotor thrust will also generate a rotational 
moment about the centre of gravity. Control input to counteract translating tendency and rotational moment causes the 
landing gear on the side opposite the antitorque rotor thrust to hang lower while hovering. This limits the cyclic control 
authority used to correct for the initiation of a dynamic roll. Some helicopters will have built-in bias to the controls or 
transmission/rotor mounting to counter this natural ‘lean’. 


Crosswinds 

15.4.32 Wind drag on a fuselage may contribute to dynamic rollover conditions. 

Tail winds 

15.4.33 Rapid antitorque inputs to counter the effect of tail winds may contribute to dynamic rollover conditions. 
Slopes 

15.4.34 Slope operations account for the majority of dynamic rollover accidents. On a sloped surface, often too 


much cyclic is held into the slope when the down slope landing gear is raised with the result that the aircraft may enter a 
dynamic rollover towards the up slope. Additionally, the helicopter will roll over if landing or takeoff is continued after 
cyclic limits are reached during slope operations. 


Main rotor design 


15.4.35 Dynamic rollover affects all types of rotor systems to some extent. Dynamic rollover appears to most affect 
teetering rotor designs. Moving the cyclic stick laterally on a teetering rotor helicopter tilts the rotor disc and the thrust 
vector but nothing more. The teetering rotor head must wait for the thrust vector to persuade the fuselage to move. 
However, with a skid or wheel acting as a pivot point, the fuselage is held to the surface and cannot move under the 
rotor disc. An articulated or hingeless rotor head that is a little out of lateral trim can rapidly produce a high upsetting hub 
moment that can result in dynamic rollover or an opposing cyclic input can quickly stop a rolling moment from 
progressing into a dynamic rollover. 
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External loads 


15.4.36 The same reaction of pivoting about a point, as seen in dynamic rollover, may occur in flight during 
external load operations should the helicopter drift laterally and a strop becomes taut. Another similar reaction is seen 
during running landings on soft surfaces should the helicopter drift laterally during run out and the helicopter's weight 
shifts onto one set of landing gear. 


Description 


15.4.37 The following description of dynamic rollover is based on a counterclockwise (CCW) rotating main rotor. 
For clockwise (CW) rotating main rotor, reverse right/left descriptions: 


a) The factors contributing to a dynamic rollover of a CCW rotating main rotor are (1) right side 
skid/wheel lower than the left with translating tendency from tail rotor thrust adding to the rollover 
force; (2) right lateral center of gravity encourages the right skid to remain in touch with the ground; (3) 
crosswinds from the left which cause disc blowback to the right; (4) left yaw inputs cause the 
helicopter to present its right skid forward. 


b) When left skid/wheel is upslope, less lateral cyclic control is available due to the translating tendency 
of the tail rotor. 


Center of gravity 


15.4.38 Control of weight and balance is an operational function and the responsibility of the operator. Approved 
loading instructions will be found in the Rotorcraft Flight Manual (RFM). Operating above the maximum weight limitation 
compromises the structural integrity of the helicopter and adversely affects performance. The helicopter may not be 
capable of lifting the maximum weight found in the RFM due to power available under the actual flight conditions. 
Balance is also critical on some fully loaded helicopters because center of gravity (CG) deviations as small as a few 
inches can dramatically change a helicopters handling characteristics. Helicopters have an internal maximum gross 
weight, which refers to the weight within the helicopter structure, and some have an external maximum gross weight, 
which refers to the weight of the helicopter plus an external load. Taking off and landing in a helicopter that is not within 
the weight and balance limits, to include subsequent landing at higher altitudes, is unsafe. 


15.4.39 The CG range in a rigid rotor system is wide; the range in a fully articulated rotor is narrow, but not as 
restrictive as the semi-rigid or teetering head, which has a very narrow range. The longitudinal CG range is larger than 
the lateral CG range, and is enhanced by the horizontal stabilizer or elevator. 


15.4.40 Center of gravity is affected by crew, passenger and baggage stowage. Fuel consumption during the flight 
may move the CG outside limits. Movement of passengers, cargo, and crew during flight may also adversely affect CG. 
Lateral CG may be exceeded in some types of helicopters by external forces such as winching/hoisting or personnel 
rappelling. CG problems may be disclosed during initial liftoff to a hover when the pilot evaluates available cyclic control 
authority. 


15.4.41 Operating above a maximum weight can result in structural deformation or failure during flight if the 
helicopter encounters excessive load factors, strong wind gusts, or turbulence. Conversely, operating below a minimum 
weight can adversely affect the handling characteristics of the helicopter and may prevent achieving the desired main 
rotor rom during autorotation. Weight and balance records contain essential data including a complete list of all installed 
optional equipment. 
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15.4.42 Out-of-balance loading also decreases manoeuvrability. Cyclic control is less effective in the direction 
opposite to the CG location. When the center of gravity is directly under the rotor mast, the helicopter hangs horizontally. 
If the CG is too far forward of the mast, the helicopter hangs with its nose tilted down. A forward CG may occur when a 
heavy pilot and a heavy passenger take-off without baggage or proper ballast located aft of the rotor mast. With a 
forward CG the helicopter will have a tendency to tuck at high speed. The situation becomes worse if the fuel tanks are 
located aft of the rotor mast and as the fuel burns the weight located aft of the rotor mast becomes less and the CG 
moves farther forward and the movement of the cyclic aft will become restricted. CG can shift forward to a point where 
not enough aft cyclic is available to bring the helicopter to a stop. In the event of engine failure and autorotation, there 
may not be enough cyclic control to flare properly for the landing. A forward CG will not be as obvious when hovering 
into a strong wind. It is essential to consider the wind velocity and its relation to the rearward displacement of the cyclic 
control. 


15.4.43 If the CG is too far aft of the mast, the nose tilts up. If flight is continued with CG aft, the helicopter may be 
impossible to fly in the upper allowable airspeed range due to inadequate forward cyclic authority to maintain a nose-low 
attitude. With extreme aft CG, gusty or rough air could accelerate the helicopter to a speed faster than that produced 
with full forward cyclic control. In this case, dissymmetry of lift and blade flapping could cause the rotor disc to tilt aft. 
With full forward cyclic control already applied a rotor blade strike on the tailboom could occur. 


Vortex ring state 
Vortex rings 


15.4.44 A helicopter in a stable hover out of ground effect (HOGE) produces total thrust equivalent to the total 
weight of the helicopter. It generates vortices along the span of the blade. At the blade tip of a hovering helicopter a 
continuous ring vortex forms that flows downward from just beneath the blade tip in the shape of a spiral. As long as the 
tip vortex remains relatively small, it has very little impact on the total thrust generated by the rotor blade. In the area of 
the blade cutout to the blade root, there is a slight upflow of air. If the collective pitch lever is lowered slightly, total thrust 
no longer equals the total weight of the helicopter and the helicopter begins a descent, seeking equilibrium between 
thrust and weight at a particular rate of descent. The upflow of air in low to moderate rates of descent decreases the 
angle of attack of the induced airflow and at the middle to outer blade sections an increase in thrust is generated and the 
helicopter descends at a steady rate. Blade tip vortices consume engine power but produce no useful lift. As long as the 
tip vortices spiral downward and are small, the only effect is a small loss in rotor efficiency. As the rate of descent 
increases, the angle of attack at the inner sections of the blade becomes larger and the blade root section enters a stall. 
A secondary vortex ring forms at the blade root at the intersection of upward flowing air and induced (downward) flowing 
air. (See Figure III-15-3.) 
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Figure Ill-15-3. Vortex ring state 
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Incipient vortex ring state 


15.4.45 If the descent rate continues to increase and the rotor blades come ever closer to the preceding tip vortex 
spirals, the tip vortices begin to enlarge. The helicopter reaches a point at which most of the power developed by the 
engine is wasted accelerating the air in a doughnut pattern. In effect, the helicopter is flying in its own downwash of 
disturbed air. The main rotor is stalled only at the inner sections near the hub. The characteristic symptoms of this 
condition are an increased low frequency airframe vibration level, pitch and roll motions, and an increase of the rate of 
descent with an increased application of collective pitch. Increasing collective pitch strengthens the blade tip vortex 
action and decreases the angle of attack, and lift generated, at the outer sections of the blade. The stall area increases 
at the inner sections of the blade. The inner and outer sections of the blades produce less thrust thus increasing the rate 
of descent. Subsequent lowering of the collective causes the inner sections of the blade to go deeper into a stall and the 
blade tip section to further reduce its lift coefficient. The helicopter has entered the vortex ring state. 


Vortex ring state 


15.4.46 Vortex ring state is a phase of flight in descent characterized by non-uniform and unsteady airflow through 
the rotor blades. It is encountered when the helicopter is at an airspeed less than the equivalent translational lift, a rate 
of descent approximately one-quarter the hover-induced velocity, and at a partial power collective power setting. At this 
point in the descent, the blade tip vortices have built up in size just beneath the rotor blades with the helicopter 
beginning to experience increasing levels of vibration and uncommanded pitch and roll oscillations. Extreme flow 
variations and vibrations start when the rate of descent is about one-half the hover-induced velocity. The vortex at the 
intersection of the upflow on the inner sections of the blades and the downflow of the outer sections moves near the 
center of the disc resulting in a net mass flow of the air through the blades of zero. The effects of vortex ring state reach 
a peak at approximately three-quarters the hover-induced velocity as the vortices periodically flow through the rotors 
creating highly unsteady and turbulent air with very high vibration levels, uncommanded pitch and roll oscillations and a 
loss of control. At approximately one and a quarter of the hover-induced velocity the effects of vortex ring state 
disappear as the disturbed wake forms in the upflow above the rotor blades. However, the helicopter is now descending 
in the turbulent wake state and is highly unstable and experiences no cyclic or collective authority and an increasing 
descent rate that may approach 6 000 feet per minute. An equilibrium autorotation will usually occur in the turbulent 
wake state in which control may be regained. 


Settling with power 


15.4.47 The term ‘settling with power’, or ‘power settling’, is used by operators to describe the flight condition when 
the helicopter keeps settling even though full engine power is applied. It is the helicopter’s equivalent of a fixed-wing stall. 
Some helicopter flight schools require a demonstration of settling with power at the incipient stages of vortex ring state. 
The normal recovery taught is to reduce collective pitch, lower the nose to increase forward airspeed and fly out of the 
disturbed air. If altitude is available, the recovery may be to enter autorotation. At some flight schools, especially military 
helicopter flight schools, where helicopters with large amounts of excess power are available, the students may be 
taught, at the initial symptoms of settling with power, to input forward cyclic with an increase in collective particularly if 
near the ground. It should be noted that the tendency on the part of a pilot when first entering into settling with power is 
to first try to stop the descent by increasing collective pitch, which, most likely, will increase the stalled area of the inner 
sections of the blade and increase the rate of descent. 
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Effect of disc loading 
15.4.48 The rate of induced airflow to the rotor disc is a function of disc loading and density altitude. Caution 


should be taken in using texts that refer to a ‘high’ rate of descent as it is relative to disc loading. Further many texts 
state that the initial effects of a vortex ring state are noticed at a rate of descent of approximately 300 feet per minute, 
one-quarter of the hover-induced velocity. This figure is based on a lightly disc-loaded helicopter, approximately 
2 pounds per square foot, and operations at sea level. A disc loading of 10 pounds per square foot at sea level would 
result in a one-quarter hover-induced velocity of approximately 685 feet per minute. At higher density altitudes, the 
induced airflow is increased to generate the same amount of thrust. Helicopter designers often delay entry into the 
effects of vortex ring state by increasing the disc loading; hence, by increasing the rate of induced airflow. 


Autorotation versus vortex ring state 


15.4.49 Upon entry into a normal autorotation with collective pitch lowered, the rate of descent is too high for vortex 
ring state to develop. Additionally, entering autorotation is a recovery from vortex ring state and settling with power. 
However, vortex ring state is sometimes encountered during very rapid flares at a low power setting at the conclusion of 
an autorotation or during quick-stop type manoeuvres. 


Insufficient power available to terminate an approach 


15.4.50 Frequently, attempts to terminate an approach to a landing at a high gross weight and/or a high density 
altitude result in the helicopter experiencing a hard landing due to insufficient power to terminate the approach. The rate 
of descent may not have been sufficient to place the helicopter in the incipient vortex ring state phase. When this occurs, 
airflow conditions through the rotor are normal and turbulent airflow and accompanying airframe vibration characteristics 
of vortex ring state have not been generated. 


Flight conditions 


15.4.51 Vortex ring state accidents are often encountered during approaches to landing. Contributing to these 
accidents are steep approaches flown at high rates of descent, high density altitudes where the margin between power 
required and power available diminishes, and downwind approaches. Other conditions that have contributed include 
formation approaches and takeoffs when the following aircraft is flown through the disturbed air from the lead aircraft, 
operating downwind with an external load, attempts to hover at HOGE at altitudes above hovering ceiling, and HOGE 
without maintaining relatively precise altitude control. 


Tail rotor vortex ring state 


15.4.52 Tail rotor vortex ring state is covered in 15.4.20, “Loss of tail rotor effectiveness.” 


Mast bumping 


15.4.53 Mast bumping occurs in underslung, or teetering, rotor systems only and is often initiated by inappropriate 
cyclic control inputs by the pilot resulting in less than 0.5 “g” flight conditions. Catastrophic mast bumping occurs inflight 
when the flapping angle of the main rotor exceeds its design limits (approximately 12°). The static stops on the blade 


yokes contact and deform the mast with sufficient force to separate the rotor from the mast. 


15.4.54 The teetering rotor system relies on lift generated by the main rotor system to counter the weight of the 
helicopter. The moments generated by the aerodynamic forces on the teetering rotor head under normal flight conditions 
keep the fuselage in its position relative to the rotor disc. Abrupt displacement of the cyclic control forward from either 


straight and level flight or at the conclusion of a climb can put the helicopter into a low “g’ flight condition. Forward cyclic 
decreases blade angles of attack as the helicopter’s up and forward momentum increases the induced flow. Similar to a 
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gyroscope, the main rotor continues on its flight path in the same attitude. The main rotor thrust of a teetering rotor in low 


eA 


g” flight is significantly decreased to a point where lateral cyclic has little, or no, effect. In a counterclockwise (CCW) 
rotor system in a low “g” condition there is little, or no, thrust to the left to counteract the right rolling moment generated 
by the tail rotor’s position above the helicopter’s centre of gravity. Tail rotor thrust is also creating a yaw to the left. In a 
low “g” flight the main rotor system still responds to cyclic control inputs but, because the main rotor is not producing 
effective thrust, the response is not transmitted to the fuselage. If the pilot initially attempts to correct the right roll with 
left cyclic input, which is a "normal" response, the flapping angle of the main rotor blades may increase enough to permit 
the static stops at the blade yokes to contact the mast. The mast on a teetering rotor is quite long; therefore, the inflight 
striking of the mast by the blade yokes generates great stress that may result in deformation of the mast and main rotor 
separation or it may allow a main rotor blade to contact the tail boom. Typically, the cross-section of a mast that failed as 
a result of mast bumping has an oval or rectangular appearance at the fracture site. Due to the unpredictable gyrations 


of a separated main rotor system, a fuselage strike may occur in flight subsequent to separation. 
Steep bank angles 


15.4.55 At bank angles approaching 90 degrees the rotor system may be inadvertently unloaded by the pilot's 


“A 


failing to maintain sufficient positive “g” (greater than 0.5 “g”) throughout the manoeuvre and recovery. Flapping angles 


of the main rotor blade at low “g” combined with lateral cyclic input may cause the blade yokes to strike the mast 


resulting in mast failure. Excessive blade flapping during a low “g” recovery from a steep bank angle may also allow a 
blade to strike the fuselage. 


Abrupt control movement 


15.4.56 Rapid roll or pitch reversals can displace the rotor disc plane faster than the fuselage can respond, leading 
to mast bumping or blade-to-fuselage contact. Abrupt control input could be the result of an external event such as a bird 
or obstacle avoidance manoeuvre. Abrupt control movements can also be produced by aircraft-pilot coupling resulting in 
collective bounce (porpoising) which can generate excessive blade flapping. 


Exceeding the flight envelope 


15.4.57 At high forward speeds in certain helicopter designs, retreating blade stall can progress to main rotor 
blowback and excessive blade flapping, resulting in mast bumping or blade-to-fuselage contact if not arrested 
immediately. Excessive lateral speed (sideslip) will also contribute to excessive blade flapping and the possibility of mast 
bumping. 


Low main rotor rpm 


15.4.58 Too low main rotor rpm from which normal rpm is unrecoverable will result in less rotational momentum 
(centrifugal force) of the main rotor blade needed to counter aerodynamic forces and coning. Such low main rotor rpm 
can result in excessive flapping of the rotor blade away from any change in relative wind which can lead to mast 
bumping or blade to fuselage contact. 


Mechanical failures 


15.4.59 Mechanical failures may initiate abrupt movement about the yaw, roll and longitudinal axis of the helicopter 
leading to mast bumping. The pilot’s reaction to a sudden failure of the engine, loss of tail rotor drive, or a sudden shift in 
longitudinal center of gravity such as loss of tail rotor gearbox or other structural components may tilt the disk beyond its 
limits and result in mast bumping. A helicopter with fixed floats will have a tendency to roll in opposition to the rotor 
flapping in sideslip, reducing the margin for blade yoke contact with the rotor mast. 
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Miscellaneous 
15.4.60 Other flight conditions that could initiate abrupt control inputs leading to mast bumping include turbulence, 


gusty wind conditions and sideways flight at or near the helicopter’s maximum allowable speed. 


15.4.61 Contributing factors include high density altitude, high gross weights and loading out of CG limits. 


15.4.62 Non-catastrophic mast bumping can also occur in such conditions as high winds during start up and 
shutdown; during slope landings; and during on-the-ground control checks. 


15.4. 63 “Droop Stop Pounding”. Multi-bladed rotor systems do have a similar phenomenon in that excessive blade 
flapping during low “g” manoeuvres may cause the blades to contact stops on the mast. While droop stop pounding 
might not fail the mast, excessive blade flapping in multi-bladed rotors occasionally does lead to blade-to-fuselage 


contact. 


Ground resonance 


15.4.64 Ground resonance is a potentially destructive coupling of blade lead-lag motion of a fully-articulated rotor 
head with the helicopter in ground contact rocking fore and aft and side to side on its landing gear when the rotor blades 
move out of phase with each other. The main rotor acts like a flywheel. The out-of-phase motion of the blades moves the 
centre of gravity away from the mast in a divergent spiral creating a vibration in the airframe. At the onset, ground 
resonance is recognizable by a slow rocking of the fuselage that develops into a wobbling vibration of increasing 
amplitude. If no remedial action is taken at an early stage, the degree of wobble may rapidly increase until the aircraft 
sustains major or destructive damage. 


15.4.65 Ground resonance is a function of dampening, both in the rotor head around the lead-lag (drag) hinges and 
in the undercarriage system. One of the most critical conditions for resonance is just before the helicopter becomes 
airborne or just prior to placing the full weight of the aircraft onto the undercarriage on landing. At these stages, the 
undercarriage components are fully extended and cannot provide the dampening required. Ground resonance has also 
occurred during power assurance checks and during ground taxi when the helicopter receives a jolt when the gear hits 
an object. If the rpm is low, the normal corrective action to stop ground resonance is to close the throttle immediately to 
quickly stop the rotor rpm and fully lower the collective to place the blades in low pitch. If the rpm is in the normal 
operating range, an attempt is usually made to lift the helicopter clear of the ground to allow the blades to realign 
themselves. 


Crew induced 


15.4.66 During the landing of a helicopter, if it is eased down to contact and held lightly on the landing gear, an 
oscillation, or wobbling motion, may be initiated leading to ground resonance. Likewise, a hard or mismanaged landing 
can also displace the blades and initiate ground resonance. The same phenomenon can occur when the take off to a 
hover is made by slowly applying collective pitch and remaining light on the undercarriage. Additionally, a sideward jolt 
while landing can displace the proper spacing of the blades and induce ground resonance. Aircraft-pilot coupling can 
further exacerbate the situation through the pilot's control input out of synchronization with the ground resonance 
oscillations. 


Maintenance procedures 


15.4.67 Manufacturers design helicopters to provide a mutual dampening between the main rotor system and the 
landing gear. Anything that upsets this mutual dampening can excite ground resonance. The main landing gear oleo 
struts and tires and main rotor lead-lag dampeners must be maintained to airworthiness standards. Uneven oleo and tire 
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pressures and dampeners not matched or out of adjustment can exacerbate the wobble created by a blade out of phase 
with the other main rotor blades. Out-of-phase motion of the blades in lead and lag can be encountered if the drag 
dampeners are not properly matched or maintained. Additionally, unbalanced main rotor blades or incorrect tracking can 
also add to the creation of excitation frequencies and wobble leading to ground resonance. Therefore, initial or 
maintenance ground operations following changes in rotor systems or flight control servos should consider ground 
resonance in pre-flight briefings. Tie-downs should be removed to ensure free landing gear movement. 


Material failure 


15.4.68 The freedom of the rotor blades about the lead lag hinges requires a mechanical damping device for each 
blade to maintain a nearly equal angular relationship between rotor blades in the plane of rotation, thus preventing 
excessive oscillation and geometric unbalance. Dampener malfunctions during landing or takeoff conditions can result in 
disrupted angular blade displacement, center-of-gravity shift and structural failure. Malfunctions during flight are usually 
not very noticeable except for slight increases in airframe vibrations. Lead lag dampeners are generally friction, hydraulic 
or elastomeric in construction and function. Friction and hydraulic types of lead lag dampener normally permit quite large 
excursions of the blades while elastomeric types of lead lag dampeners do not allow the blades to wander far from the 
proper geometric spacing and, hence, tend to provide better resistance to ground resonance. 


Air resonance 


15.4.69 A similar phenomenon to ground resonance has been seen inflight particularly with hingeless rotors. 
Modern hingeless rotors have some sort of lead-lag dampener and dampeners in the pylon restraint system. The 
helicopter may enter a potential instability and wobble while airborne called air resonance that may occur due to 
dynamic coupling of the rotor flexibility and the pylon restraint flexibility. The same considerations apply to air resonance 
as to ground resonance except that the pylon restraint variables replace the landing gear variables. Air resonance has 
occurred during maximum performance conditions such as carrying an external load with the pilot’s correction to air 
resonance to drop the load and change the dynamics between the rotor and pylon. 


Collective bounce 


15.4.70 Collective bounce, sometimes called porpoising, is an aircraft-pilot coupling phenomenon that is caused by 
the movement of the collective lever in a direction opposite to the fuselage’s longitudinal movement resulting in aircraft 
dynamics that unexpectedly deviate quickly from the pilot's expectations of control and response. The adverse 
movement created by collective bounce can amplify quickly in magnitude and, if not corrected, can result in loss of 
control or in destruction of the helicopter in three or four pulses. This condition normally initiates when there is excessive 
free play in the collective lever emphasizing a bio-dynamic reaction in the pilot's arm controlling the collective. Aircraft 
accelerations on the pilot's arm magnify the amplitude of the vertical accelerations. Additionally, the mechanical and 
aerodynamic delays between control input and reaction of the helicopter may cause the pilot to increase control input 
more than required. When the helicopter reacts to this initial set of inputs the pilot may input opposite control to correct 
and get out of synchronization with the actual movements. This phenomenon can occur in any phase of flight from 
hovering to high speed forward flight and is normally initiated by the pilot's reaction to an external event such as gusty 
winds or a bird avoidance manoeuvre. An environmental condition that can hinder recovery from collective bounce is the 
availability of, or inappropriate selection of, external visual references needed to avoid or recover from collective bounce. 
While collective friction is recommended to prevent the occurrence of collective bounce, excessive breakout from a tight 
collective friction setting can also lead to collective bounce. Collective bounce in flight may lead to instability in the main 
rotor system and could initiate main rotor blade contact with the fuselage or mast bumping. 
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15.4.71 Helicopter external loads can also lead to longitudinal and lateral oscillations in a hover and in forward 
flight resulting in catastrophic collective bounce. Coupling effects from a slung load are a function of load pendulum 
stability, pendulum frequency, phase delay and pilot control reaction and are normally greatest in a lateral motion. Other 
factors may include aerodynamics of the load, length of load straps and cables, elasticity of the straps and cables, rotor 
wake, and spin rate of the load. An out-of-phase reaction by the pilot can result in sustained or uncontrollable oscillations 
resulting in loss of the load, overstress of the helicopter or loss of control. 


15.4.72 A similar aircraft-pilot coupling phenomenon can also occur laterally in a hover as the pilot’s reaction 
becomes out of synchronization with the actual movement of the helicopter. Though it may not lead to destructive forces 
on the helicopter it can lead to loss of control. Aggravating this phenomenon could be having the cyclic trim in the “off” 
position, leaving no relationship between current cyclic position and cyclic neutral position. Uncontrolled lateral 
oscillations in a hover can lead to inadvertent touchdown and dynamic rollover. 


15.4.73 “Ground bounce”, normally a benign condition, occurs while operating on the ground. This undesirable 
phenomenon starts with the helicopter bouncing in the vertical axis and then is aggravated by an aircraft-pilot coupling in 
an attempt to stop the bounce with the collective, particularly if there is little or no friction in the collective. The pilot’s arm 
moves in a direction opposite to that of the fuselage. Ground bounce can increase rapidly in amplitude. Ground bounce 
may induce ground resonance. 


Height-velocity diagram 


15.4.74 The height-velocity diagram is often referred to as the Deadman’s Curve. It defines an envelope of 
airspeed and height above the ground from which a safe power-off or one engine inoperative landing cannot be made. 
Prior to January 31, 1983, the height-velocity diagram was an operating limitation. It restricted operating helicopters in 
various utility applications. Now, the height-velocity diagram is performance information for Category B helicopters with 9 
or fewer passenger seats but remains a limitation for Category A helicopters and Category B helicopters with 10 or more 
passenger seats. Height-velocity diagrams are based on a one-second delay in the pilot taking appropriate action. 


15.4.75 The capability of a helicopter to perform a safe autorotative landing after power failure is limited by the 
structure and design of a particular helicopter for certain combinations of geometric height and airspeed. For single 
engine helicopters and multiengine helicopters without engine isolation, the height-velocity diagram is based on sudden 
failure of all engines. (See Figure IIl-15-4.) Power failures in the shaded (avoid) areas of the diagram for high speed 
flight and level flight (cruise) may result in high risk of severe damage to the helicopter and injury to the occupants. If an 
autorotation was initiated from a high altitude/low airspeed combination expect high vertical impact forces. If an 
autorotation was initiated from a low altitude/high airspeed combination expect high horizontal impact forces. An engine 
failure while descending through the knee of the diagram is less critical provided a safe landing area is available. The 
shaded areas of the diagram are separated by a takeoff corridor providing a path clear of the avoid areas for a pilot to 
take off using normal pilot skills. 


Inflight icing 


15.4.76 Inflight icing affects the airflow about exposed surfaces, surface irregularities and inlets. Accretion of ice 
varies with time of exposure to icing conditions, temperature and size of water drops, relative humidity, and the shape of 
the surface and inlets. lce forms when humidity is high and temperatures are at or below 32°F (0°C). Ice will form on the 
upper surfaces of a helicopter’s main rotor blade where pressure is reduced due to increased relative flow velocities 
creating a decrease in air pressure and temperature. The irregular shape of the ice formed decreases the aerodynamic 
efficiencies of the blade. 
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15.4.77 The rate of ice accretion on small surface areas such as inlet screens, drains and vents is a function of 


aircraft speed. The accumulation of ice on the rotor blades is a function of rotational speed. Blade sections going faster 
encounter more droplets per second and accrete ice at a faster rate. Blade sections traveling at higher relative velocities 
produce heat through friction and may discourage ice from forming near the blade tips in normal flight. For example, in 
the temperature range of 32°F to 20°F (0°C to 6°C), ice will form on the leading edge of blades from the root to 
approximately 70 per cent out toward the tip with the maximum build-up of ice occurring in the middle of the affected 
area. Generally, at that temperature range, the last outer 30 per cent of the blade where most of the lift is generated in 
powered flight remains free of ice due to heat friction. 


15.4.78 Rapidity of performance degradation of inflight icing is dependent upon the severity of icing conditions and 
ice shape. Inflight icing will cause an increase in the drag coefficient. Passive anti-icing systems to counter the 
accumulation of ice include materials and coatings. The pilot’s first warning of ice accumulation may be an increase in 
collective pitch to maintain level flight and an increase in power to maintain rotor rpm. 


15.4.79 Ice frost may adhere to the rotor surface while the helicopter is on the ground with the rotors stopped or 
with the rotors turning. Rotor blade efficiency and helicopter range, climb rate and hover performance are considerably 
reduced by small amounts of ice frost. Visibility through the windshield may become restricted as condensation on the 
inside of the windshield turns to ice. Should the ports for the pitot-static system ice over, gross inaccuracies in altitude 
and airspeed could prohibit safe flight in instrument conditions. 
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15.4.80 Light inflight icing on rotors and aerodynamic surfaces may result in sluggish flight controls and airframe 
vibration. Ice will form on sharp edges, antennae, control linkages and similar items. Ice increases the weight of the 
helicopter and increases the lift requirement. Droop stops may malfunction due to ice accumulation. 


15.4.81 Moderate amounts of ice accumulation on the rotor blades may cause the helicopter to enter a descent 
despite the use of all available power. Ice accumulation on the tail boom may put the helicopter outside the longitudinal 
CG limits. 


15.4.82 A certain amount of ice must build up before natural shedding can occur. High lift and flexible blades are 
better at shedding ice than high performance and stiffer blades. Outside air temperature has a strong influence on 
shedding. Rapid control inputs or rotor speed changes may induce asymmetric shedding. Asymmetric shedding of ice 
from main and tail rotor blades will cause an imbalance, flexing of the blades and an increase in airframe vibrations. 
Main rotor blade imbalances created by ice shedding may result in main rotor instability and potentially destructive 
vibrations. Stress levels imposed on the rotor system and airframe may exceed structural and fatigue limits of the blade, 
mast, and main and tail rotor support structures. Further, ice shedding may damage flight essential components, 
creating hazards to flight. Shedding ice while on the ground creates hazards to ground personnel, passengers and 
equipment in proximity to turning rotors. 


15.4.83 Thin, high performance blades are more vulnerable to icing than thicker, high lift blades. Small radius 
blades with higher rotor rom tend to accumulate ice at a faster rate than blades that rotate at lower rpm. 


15.4.84 Inflight icing may seriously degrade autorotation characteristics. The efficiency of the rotor blade is low. In 
autorotation, the driving region of the blade is located near the middle of the span that is also the area of greatest 
accumulation of ice. The autorotation rate of descent must be higher to compensate for the loss of efficiency. The 
collective down stop may be too high to establish the desired rotor speed. The safe minimum rotor speed to maintain an 
acceptable rate of descent will be higher than normal. With higher drag created by ice on the blades, the ability to build 
up rotor speed in the flare will be less. Because maximum lift capability is lower, the increase in load factor that can be 
generated through an increase in collective pitch increase at the completion of the autorotation is minimal or nil. The 
investigator may find that the main rotor rom decreased and the main rotor blades entered excessive flapping with 
catastrophic results. 


15.4.85 Since very few helicopters are approved to operate in known icing conditions, icing is rarely encountered in 
normal helicopter operations. Those that are approved to operate in known icing conditions are normally larger 
helicopters that have an ice detection system or a means to determine the formation of ice on critical parts of the 
helicopter. Rotor blade de-icing is normally electric with supply from a transmission-mounted AC generator. Engine inlets 
may be heated electrically or by a bleed air system. For those helicopters that do have de-icing systems the 
investigation must consider that there are limits to the use of these systems. Flight through freezing rain or freezing 
drizzle is prohibited. Incomplete shedding using a de-icing system may occur if the system is initiated before there is 
sufficient accumulation of ice on the blades. Other problems may occur should the de-icing system cycle out of phase 
and cause asymmetric ice shedding. The system may fail. Following the failure of the de-icing system, the helicopter 
should be controllable for 15 minutes. In the event of engine failure, a helicopter approved for flight in known icing 
conditions should be able to safely complete an autorotation. 


Ill-15-30 Manual of Aircraft Accident and Incident Investigation 





Over pitching 


15.4.86 Over pitching is a phenomenon that happens when collective pitch is increased to a point where the main 
rotor blade angle of attack creates so much drag that all available engine power cannot maintain or restore normal 
operational rpm. At low rotor rpm, blade angle of attack increases, coning increases and drag increases. Up collective 
will only result in further decay in rotor rom. The high inflow angles and rotor drag quickly decay main rotor rpm. The 
main rotor rpm may decrease to a point where all rotor blades stall. Tail rotor is affected; antitorque control may be lost. 


15.4.87 If the pilot allows rotor rpm to decay to the point where all the rotor blades stall, the result at altitude is 
usually fatal. It can occur in a number of ways such as simply allowing the main rotor rpm to decay, slow coordination 
between throttle application and increasing collective pitch, rolling the throttle the wrong way, and pulling more collective 
pitch than power available. When the rotor rpm decreases, the pilot tries to maintain the same amount of lift by 
increasing pitch. As the pitch increases, drag increases, which requires more power to try to accelerate the blades back 
to the proper rpm. When power is no longer available to maintain rpm, and therefore lift, the helicopter begins to 
descend. This changes the relative wind and further increases the angle of attack. At low rotor rpm, high coning angles 
develop producing high stress levels in blade bending. Large flapping angles or controllability problems may develop. At 
some point the blades will stall unless rpm is restored. Lowering the collective to full may deepen the stall. If all blades 
stall it is impossible to get smooth air flowing across the blades. The rotation of the blades may stop before the 
helicopter descends to the surface. 


15.4.88 A technique to recover from over pitching in a hover is for the pilot to immediately apply additional throttle, 
if available, while slightly lowering the collective. This reduces main rotor pitch, coning angle and drag. This technique 
may be repeated several times to regain normal operating rom, hence it is sometimes called “milking the collective.” 
When operating at altitude, the collective is normally lowered only once to try to regain rotor speed. The amount of 
collective pitch lowered depends on the altitude. 


15.4.89 Over pitching can occur in any phase of powered flight. High gross weight, high density altitude and high 
temperatures are contributing factors. Abrupt application at the conclusion of an autorotation, quick stop, approach to 
landing or balked landing and operations in conditions where hover out of ground effect is not feasible may cause the 
helicopter to enter over pitching. 


15.4.90 Over pitching to low rotor rpm and blade stall is greatest in small piston powered helicopters with low blade 
inertia. With a piston engine, engine rpm will also decrease and may cease operation during over pitching. 


15.4.91 Turbine engines are also susceptible to over pitching though the frequency of occurrence is much lower. 
When operating at a low power level such as in an autorotation, the turbine gas generator is also turning at a low rpm. 
An increase in collective pitch at the conclusion of the autorotation requires a power demand from the free turbine. The 
lag in power response results in a “droop” in main rotor rpm. The application of throttle and collective might not be 
coordinated and the governor might not increase fuel flow fast enough. Should the application of up collective pitch be 
abrupt, the droop may be large enough to slow the rotor to the point of over pitching. Most turbine helicopters 
incorporate the use of an “anticipator” in collective movement to counter the lag in power response. 


15.4.92 A low rotor speed warning is required on all single-engine rotorcraft and on multi-engine rotorcraft where 
there is not an automatic increase in remaining engine(s) power output upon failure of an engine. Most all multi-engine 
helicopters have this warning installed by the manufacturer. The auditory portion of the alarm for low rpm is normally 
distinct to avoid warning system confusion. The low rpm warning system normally has a pilot activated deactivate switch 
or button. At least one manufacturer has installed a low rpm warning deactivation switch at full down collective position. 


Part Ill. Investigation 
Chapter 15. Helicopter Investigation Il-15-31 





Retreating blade stall 


15.4.93 Retreating blade stall results whenever the angle of attack of the retreating blade exceeds the stall angle of 
attack of the blade section. This condition begins benignly in moderate speed flight at the tip of the retreating rotor blade 
because of blade flapping and the slower relative air flow. In order for the retreating blade to develop the same thrust 
and lift as the advancing blade, the retreating blade must operate in this slower air flow at a greater angle of attack. If the 
blade pitch is increased or the forward speed increased, the stalled portion of the rotor disc becomes larger with the stall 
progressing toward the hub from the tip of the rotor blade. The helicopter may begin to vibrate at a low frequency that is 
proportional to the number of rotor blades and the rotor speed. As blade pitching moments are fed back through the 
rotor head and flight control system, vibrations, roughness, and stick shaking may be felt. When approximately 15 per 
cent of the rotor disc is stalled, the helicopter may enter a violent nose pitch up, heavy vibration and a rolling tendency in 
the direction of the retreating blade. The stall condition prevents flapping to equality and the greater blade angle places 
the retreating blade into a deeper stall condition. If the stall is severe, pitch-up tendency may become uncontrollable and 
the helicopter may enter a partial or irrecoverable loss of control. 


15.4.94 If the conditions for retreating blade stall are approached slowly, adequate warning in the form of vibrations 
and control feedback are provided. 


Recovery 


15.4.95 Moving the cyclic aft only worsens the stall as aft cyclic produces a flare effect, thus increasing angles of 
attack. Pushing forward on the cyclic also deepens the stall as the angle of attack on the retreating blade is increased. 
Correct recovery from retreating blade stall requires the collective to be lowered reducing the angle of attack then aft 
cyclic to slow the helicopter. If low rotor rpm was a factor in encountered retreating blade stall, the rotor rom needs to be 
increased. 


High density altitude 


15.4.96 As density altitude increases, higher blade angles of attack are required to maintain lift at a given airspeed. 
High gross weight 
15.4.97 As weight of the helicopter approaches maximum gross weight, higher blade angles of attack are required 


to produce greater lift to oppose the greater weight. 
Low rotor rpm 


15.4.98 As main rotor rpm decreases from normal operating rotor rpm, higher blade angles of attack are required 
to obtain a given thrust from the rotor, thus a higher angle of attack. 


Manoeuvring 


15.4.99 Excessive or abrupt control deflections at high forward speed will increase the lift requirement and blade 
angle of attack. 


Wind gusts 


15.4.100 Sharp updrafts result in temporary increases in the blade angle of attack. 


Ill-15-32 Manual of Aircraft Accident and Incident Investigation 





Advancing blade stall 


15.4.101 Advancing blade stall is encountered under similar flight conditions as retreating blade stall: high airspeed, 
high density altitudes, and high gross weights. At high advancing blade Mach numbers in the area of the blade tip, 
airflow compressibility effects due to the formation of localized upper surface shock waves shift the centre of pressure aft. 
Sharp rises in drag associated with the shock waves produce a disturbed airflow. Vibrations are felt throughout the 
helicopter. The nose of the helicopter tends to pitch down and the helicopter tends to roll in the direction of the 
advancing blade stall. Under certain conditions, the helicopter may suffer structural damage. Some new rotor blade 
designs counter this advancing blade effect with the outer portion of the blade being swept aft, or with blade twist to 
reduce the angle of attack at the blade tip. 


Density altitude 


15.4.102 Density altitude is the altitude in the standard atmosphere corresponding to a particular value of air density. 
While density altitude is often interpreted as pressure-altitude corrected for non-standard temperature differences, in 
helicopter operations moisture content of the air is included in the definition. Higher density altitudes mean less 
helicopter performance. High density altitudes may be present at low elevations on hot days. 


15.4.103 Density altitude, more than any other factor, affects the operational performance of the helicopter. Most 
performance graphs and calculations as provided in rotorcraft flight manuals are based on the effects of density altitude 
on hover performance. For instance, as density altitude increases, power required to hover increases. In the thinner air 
of higher density altitude, the angle of attack on the blade is increased with increased drag to provide the same lift as at 
lower altitudes. Height-velocity diagrams are affected by changes in density altitude. As density altitude increases, the 
minimum cruise height increases and the minimum velocity increases at the knee of the curve. 


15.4.104 Engine power output decreases with increasing density altitude. All engines reach an altitude above which 
power production begins to decrease. A non-supercharged piston engine decreases power production with increasing 
altitudes above sea level. Supercharged piston engines will maintain power production up to a certain altitude above sea 
level and then decrease power production above that altitude. A typically de-rated turbine engine will produce the same 
engine power from sea level up to a much higher altitude than a supercharged piston engine, but it too will reach an 
altitude above which power production decreases. At very high density altitudes, maximum throttle on any helicopter 
might not produce 100 per cent normal rotor rpm. (See Figure III-15-5.) 


15.4.105 In the thinner air of high density altitudes, the main rotor blades must operate at a higher angle of attack to 
produce the same lift as at sea level. With the higher angle of attack, the helicopter induces a greater inflow above the 
rotor disc and produces a higher downwash velocity. 


15.4.106 Partial pressure of higher density altitudes will have an affect on systems. For instance, fuel boost pumps 
may be required to be on above certain altitudes to provide sufficient pressure to the engine-driven fuel pump. 


15.4.107 As density altitude increases, gross weight will have to be reduced. 


15.4.108 The maximum hover height in ground effect lowers with increasing density altitude. A density altitude may 
be reached where hovering in ground effect and climbing vertically after takeoff may not be possible. 


15.4.109 At high density altitudes, tail rotors encounter the need for more power to increase angle of attack to 
produce thrust sufficient to counter main rotor torque. For some helicopters, the increasing power requirement from the 
antitorque rotor with increasing density altitude impacts performance capability. During high altitude operations, the 
maximum antitorque produced by the tail rotor during a hover may not be sufficient to overcome main rotor torque even 
if the gross weight is within limits. Some helicopters have a maximum density altitude based on antitorque capability. 
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Ground effect 


15.4.110 Helicopter ground effect can be equated to a similar fixed wing phenomenon. Compared with performance 
required to hover out of ground effect (HOGE), hovering in ground effect (HIGE) has beneficial gain in lift production or 
in reducing power required to hover at the same weight when hovering approximately one rotor disc diameter or less 
above the surface. At that HIGE, induced downwash ceases its vertical velocity, reducing the induced flow at the rotor 
disc. (See Figure Ill-15-6.) The angles of attack on the blade increase with a corresponding increase in lift. Ground effect 
also makes a larger portion of the blade produce lift by restricting the generation of blade tip vortices. 


15.4.111 Above one rotor disc diameter, with no forward speed, induced airflow is no longer restricted and blade tip 
vortices increase. As a result, drag increases which means a higher pitch angle and more power is needed while 
hovering out of ground effect to move the air down through the rotor. Power required for HOGE is higher than power 
required for HIGE. 


15.4.112 Upon takeoff from HIGE, as airspeed begins to increase, the benefits of ground effect reduce until effective 
translational lift (ETL) speed is reached. Power required from hover to ETL increases to maintain same lift capability and 
same height above the surface. Once ETL is reached, the power requirement rapidly decreases to climb power. Unlike 
the fixed wing ground effect phenomenon, helicopter ground effect disappears at a relatively low speed after 
transitioning through ETL. 


15.4.113 Ground effect is at its maximum in a no-wind condition over a firm, smooth surface. Tall grass, rough 
terrain, revetments, proximity to buildings and water surfaces alter the airflow pattern, causing recirculation and an 
increase in rotor tip vortices. 


15.4.114 Irregular surfaces may be found in external load operations, logging, and winching and from platforms, 
buildings, ridges, saddles, sloping terrain, and confined spaces. It is possible that on approach or in a hover over an 
irregular surface to have part of the rotor disc in ground effect and the remainder out of ground effect. This will generate 
a pitch or rolling moment in the helicopter as a result of the non-symmetrical rotor thrust production over the entire disc. 


Performance charts 


15.4.115 Helicopter performance revolves around whether or not the helicopter can be hovered. A hover requires 
more power than any other flight regime. Hover is significantly influenced by density altitude. In developing performance 
charts, aircraft manufacturers make certain assumptions about the condition of the helicopter and the ability of the pilot. 
It is assumed that the helicopter is in good operating condition. Engine performance is based on the installed minimum 
performance specification engine unless normally depreciated engine performance is approved. The pilot is assumed to 
be following normal operating procedures and to have average flying abilities. Average means a pilot capable of doing 
each of the required tasks correctly and at the appropriate times. Manufacturers do not test the helicopter under each 
and every condition shown on a performance chart, they mathematically derive the remaining data. Though they may 
take into account the effects of operational use, such as allowing for dirty blades and worn bearings, manufacturers do 
not have to build in safety factors in performance data. However, the certifying authority is responsible for conducting 
periodic tests to check the adequacy of the performance data. 


15.4.116 Each rotorcraft flight manual (RFM) is unique, containing specific information about that particular aircraft, 
equipment installed, and the helicopter’s weight and balance. The Limitations section includes those limitations required 
by regulation and any limitation information the manufacturer feels necessary for safe operations. Certain performance 
charts located in the Performance Data section may be limitations if referenced as such in the Limitations section. 
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Figure Ill-15-6. Hovering in ground effect 
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15.4.117 Weight limits are found in the Limitations section. For weights that vary with altitude, temperature and other 
variables, graphs are normally provided in the Performance Data section and are considered limitations by specific 
reference to these weight graphs in the Limitations section. Similarly, center of gravity (CG) graphs found in the 
Performance Data section may be limitations by specific reference to these CG graphs in the Limitations section. 


15.4.118 The Performance Data section includes all information required by regulation and any additional 
performance information the manufacturer feels may enhance safety. Common graphs found in the Performance Data 
section that may be useful during an investigation include: 


a) power assurance chart; 


b) hover information: Hover performance in ground effect and out of ground effect for single engine 
and/or multiengine operation and includes any relative wind effects; 


c) takeoff and landing and climb performance: Takeoff and landing profiles, height-velocity curves, 
autorotation speeds, takeoff and landing over 50-foot obstacles, and any other data applicable to the 
particular helicopter; 


d) airspeed calibration; and 


e) the height-velocity (H-V) diagram is performance information for Category B helicopters weighing 
20 000 pounds or less and with nine or fewer passenger seats. However, the height-velocity diagram 
is a limitation for Category A helicopters and Category B helicopters with 10 or more passenger seats. 
Alternatively, for Category A helicopters, if procedures and profiles contained in the Normal 
Procedures section or the Performance Data section provide similar information as contained in the H- 
V diagram and are referenced as mandatory requirements in the Limitations section, then an H-V 
diagram in the Limitations section is optional. 


15.4.119 The Operational Equipment Supplement section may modify limitations, procedures (both normal and 
emergency) and performance characteristics of the basic helicopter. This section often contains information that may not 
correlate well if two or more optional equipment packages are installed on the particular helicopter. 


15.4.120 Performance data presented in the Manufacturer's Data, or “unapproved”, section should not include data 
that is beyond operations limitations. For instance, if weight-altitude-temperature (WAT) limits for takeoff and landing are 
based on in-ground-effect performance capability at a 5-foot skid height, 3-foot skid height hover performance data 
allowing an increase in hovering weights should not be presented in the Manufacturer's Data section unless clearly 
identified as being beyond operating limitations for normal operations. 


15.4.121 Weight and balance, as opposed to weight and loading, is found in a separate section. In that section will 
be crew tables, passenger tables, fuel and oil tables, cargo tables and any other loading table applicable to the particular 
helicopter. 


15.4.122 Rotorcraft performance can vary greatly over a short flight due to large changes in weight, density altitude 
and hover requirements. This can cause additional rotorcraft performance calculations when flight conditions or missions 
change. Records of such mission profile changes and performance calculations are essential for safe flight performance 
and should be considered in accident investigations. 
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Effective translational lift 


15.4.123 From an operational view, translational lift is the additional lift (or rotor thrust) obtained at the same power 
setting from increased rotor system efficiency upon increasing airspeed beyond 12 to 16 knots. 


15.4.124 In a stable hover in a no-wind condition with only a vertical air flow component through the rotor blades, a 
helicopter is not generating translational lift. This can be visualized as the rotorcraft balancing on a bubble of air. 
Translational lift begins with any horizontal flow of air across the rotor. At very low speeds, translational lift is practically 
impossible to detect by the pilot. At approximately 5 to 7 knots, the vortices in the front of the helicopter move inward to 
under the rotor blade tip. Air from the vortices flows through the rotor with a downward component. Without a change in 
collective pitch, or power, the rotor does not generate as much induced velocity to the air, hence does not generate as 
much lift as it did in the hover. The helicopter settles slightly. As the aircraft increases speed through 12 to 16 knots, 
translational lift becomes noticeable as airframe vibration and shudder. At this speed, the rotor moves out of its vortices 
and enters into relatively undisturbed air. The change in air flow through the rotor towards horizontal increases the blade 
angle of attack and lift. The helicopter has reached an airspeed known as effective translational lift. The nose tends to 
pitch up. Without cyclic input the helicopter begins to climb, hence the term translational lift. In the undisturbed air, tail 
rotor efficiency improves, thrust increases causing the helicopter to yaw left and develop a translating tendency caused 
by tail rotor thrust above the centre of gravity to roll the helicopter to the right in a counterclockwise (CCW) rotor system. 
If the takeoff were continued horizontal, the pilot could progressively reduce power until the helicopter reaches 
approximately 50 to 60 knots. Beyond this speed, parasite drag is greater than translational lift efficiencies and the 
collective must be increased to reach higher airspeeds. 


15.4.125 During an approach to hover or running landing, the helicopter is flying first in undisturbed air and reaches 
a speed of approximately 16 to 12 knots where the helicopter enters its vortices and loses translational lift. At this point, 
the helicopter will increase its descent rate unless power is increased to compensate for the loss of translational lift. Tail 
rotor thrust must be increased to compensate for operation in disturbed air and the increase in main rotor thrust. 


15.4.126 While wind may be a significant factor in achieving translational lift, operating under adverse wind 
conditions may create rapid and unpredictable changes to translational lift values, particularly when mountain flying or 
operating near obstacles. Downdrafts may occur just as the helicopter is increasing power to compensate for the loss of 
translational lift. When operating on the lee side of a mountain at low airspeed on landing or takeoff, the helicopter may 
cross a horizontal shear boundary or it may pass through a temperature inversion, severely impairing translational lift. 


One engine inoperative 


15.4.127 In the event a multi-engine helicopter experiences an engine failure in a critical phase of flight, the primary 
determinant for a successful landing is the amount of excess power available in the remaining engine(s). The helicopter 
is particularly vulnerable at flight conditions with high power settings such as in a hover and on application of power for 
takeoff and landing. Contributing factors include aircraft weight, center of gravity and density altitude. 


15.4.128 Multi-engine helicopters can be either Category A or Category B. For Category A helicopters, the concept 
of one-engine-inoperative (OEI) limits helicopter takeoff weight such that if an engine failure occurs at or before the 
takeoff decision point (TDP) a safe landing can be made or if the engine fails at or after TDP, the takeoff can be 
continued. 


15.4.129 Use of the TDP is analogous to V1 in transport aircraft. Prior to TDP the pilot is “stop” oriented as the 
helicopter has yet to achieve sufficient energy to assure continued flight. At TDP, the pilot becomes “go” oriented and 
should the engine fail at or beyond this point, takeoff should be continued because no longer is there sufficient surface 
area to abort the takeoff. Contingency power rating on the good engine should be used for as long as it is permitted. 
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15.4.130 Older engine control systems on multi-engine turbine helicopters provide OEI contingency power ratings 
that are not significantly higher than twin engine operation. Full Authority Digital Electronic Control (FADEC) systems 
have provided great improvement in OEI contingency power performance. Normally for non-FADEC systems, engine 
limitations for OE! are 30 minutes and 2.5 minutes. FADEC engines normally have 30-second and 2-minute contingency 
ratings. FADEC systems normally incorporate a training mode switch to artificially lower the limits of the ‘good’ engine so 
that OEI training can be conducted. The FADEC computer should automatically override the training mode switch if the 
computer senses that the ‘good’ engine has failed. 


15.4.131 Fuel system limitations and other various limiters may prevent the engine from achieving OEI power on 
demand. Normally, electronic controls can sense an engine failure and automatically reset the operating limiters upward 
from “normal” to “OEI” limits. 


15.4.132 The landing decision point (LDP) is a commit point to landing. Should a multi-engine helicopter experience 
an engine failure prior to LDP, the pilot has a choice of continuing the approach or initiating a balked landing. After 
passing LDP the helicopter no longer has sufficient energy to assure transition to a balked landing without contacting the 
surface and is committed to a landing. Balked landing is not applicable to Category B helicopters. 


15.4.133 Use of all-engines-operating (AEO) total power available on takeoff is not normally operationally feasible 
due to such factors as height-velocity constraints. 


15.4.134 Takeoff and landing data in the Performance Data section of the Rotorcraft Flight Manual were developed 
for operations to smooth, dry, hard, level surface conditions. Additionally, OEIl data was developed with bleed air 
systems such as cabin heat and windshield defroster off. 


15.4.135 Fundamental to the concept of limited-use OE]! rating is the requirement that OEI power will be available 
when needed. Success is strongly dependent on the validity of the database, maintenance of the engines, sensor and 
indicating systems and the care taken during the conduct of the power check. FADEC-equipped engines are capable of 
providing continuous trend monitoring. 


15.4.136 Conventional periodic power assurance and topping checks are impractical with the limited-use rating 
concept because of the rapid expenditure of useful life during exposure at the engine speeds and temperature 
consistent with limited-use ratings. 


15.4.137 If the helicopter descends too low during a continued takeoff or balked landing it may not be able to enter a 
landing flare, if necessary. 


15.4.138 Aft center of gravity may restrict forward visibility over the nose. Forward centre of gravity may affect climb 
performance. 


15.4.139 The technique used during takeoff may be significant in the success of OE! operation. Under or over 
rotation on initiation of takeoff and under or over application of takeoff power may lead to missed airspeed and altitude 
targets essential to successful OE! operation. 
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Loss of tail rotor effectiveness 


15.4.140 Loss of tail rotor effectiveness (LTE), or unanticipated yaw, is a critical, low speed aerodynamic flight 
characteristic which can result in an uncommanded rapid yaw rate which does not subside on its own accord and, if not 
corrected, can result in the loss of aircraft control. LTE is not related to an equipment or maintenance malfunction and 
may occur in all single-rotor helicopters with antitorque rotors. The tail rotor does not stall, it becomes inefficient and 
cannot produce enough thrust to stop the yaw rate. While other factors may influence LTE, it is usually caused by either 
the effects of certain wind azimuths (direction) while at airspeeds less than 30 knots or allowing excessive yaw rates to 
develop. Demands on tail rotor thrust increase with increasing gross weight and density altitude. At high density altitudes, 
hovering ceiling may be limited by tail rotor thrust margin and not necessarily by power available. Such conditions may 
also be encountered during external lifts. If the load is excessive, the main rotor rpm may decrease, or the antitorque 
effectiveness of the tail rotor may be exceeded resulting in an uncontrolled yaw. 


15.4.141 During design, the tail rotor is sized to balance main rotor torque and to provide directional stability 
moments. It is tested to provide a sufficient margin of yaw control for flight manoeuvres and to compensate for given 
ambient wind effects. LTE occurs to the right in single rotor helicopters with a counterclockwise (CCW) rotating main 
rotor and an antitorque rotor. 


15.4.142 Certification testing assumes that the pilot is knowledgeable of the critical wind azimuth and maintains 
control of the helicopter by not allowing excessive yaw rates to develop. 


15.4.143 Effect of the wind. When the wind is on the nose of a helicopter in a hover or at a low speed less than 30 
knots, the fuselage and vertical stabilizer tend to weathervane and hold the nose of the helicopter into the wind. If the 
wind is from a side, the helicopter tends to weathercock in that direction. The requirement for tail rotor thrust varies 
depending on which side the wind strikes the helicopter. For a helicopter with a CCW rotating main rotor, wind from the 
left side reduces tail rotor efficiency and creates a tendency to yaw to the right. 


a) Winds from 120° to 240° relative, helicopter attempts to weather vane its nose into the relative wind. 


b) Winds from 210° to 330° relative cause a tail rotor vortex ring state to develop. The air flow will be 
non-uniform and unsteady into the tail rotor creating thrust variations. 


c) Winds from 285° to 315° relative cause the main rotor vortex to be blown into the tail rotor by the 
relative wind creating extreme turbulence. 


15.4.144 Factors that influence the severity of the onset of LTE: 


a) Gross weight and density altitude. An increase in either decreases the power margin between 
maximum power available and power required to hover; 


b) Low indicated airspeed. At 30 knots and below, the tail rotor is required to produce nearly 100 per cent 
of the directional control. Additionally, at airspeeds below effective translational lift, the helicopter 
requires a significant increase in collective/thrust to maintain height above the surface, decreasing the 
margin between maximum power available and power required to hover; 


c) Hover height. Hovering out of ground effect requires greater power and torque, decreasing the margin 
between maximum power available and power required to hover; and 


d) Main rotor rom droop. Rapid power application may cause a transient droop to occur. Any decrease in 
main rotor rpm will cause a corresponding decrease in tail rotor rom and thrust. 
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15.4.145 Downwind operations contribute to LTE. Downwind turns to the right with a CCW rotor system at low air 
speed may induce an unanticipated yaw to the right leading to LTE. The sudden increase in lift/torque requirement 
during loss of translation lift during a downwind approach, particularly at high gross weight and high density altitude, may 
exceed tail rotor antitorque power availability. 


15.4.146 If considerable antitorque pedal is required and maintained during a phase of flight such as hovering 
HOGE with an external load, there may not be enough antitorque pedal left to counteract an unanticipated yaw. 


15.4.147 A collective reduction to reduce torque is a recommended procedure to control LTE. It may cause an 
increase in descent rate and inadvertent contact with the surface. If control cannot be regained, if altitude permits, an 


autorotation may be the best course of action. 


15.4.148 Tail rotor thrust availability may be limited by improper tail rotor rigging. 


Chapter 16 


INVESTIGATING HUMAN FACTORS 


16.1 GENERAL 


16.1.1 This chapter of the Manual of Aircraft Accident and Incident Investigation is intended as a general guide to 
the investigation of the human contribution to aviation occurrences. In keeping with Circular 240, Human Factors Digest 
No. 7, Investigation of Human Factors in Accidents and Incidents, the chapter advocates a systems approach to the 
investigation. Whether the investigation is conducted by a single investigator or a team of investigators, the use of a 
systematic approach will ensure that the investigation of human factors is integrated within the investigation proper and 
not relegated to the rank of a residual capacity activity, something that happens only if one is allotted enough time and 
sufficient resources. For both the single investigator and the investigation team, the use of such an approach will make 
the occurrence investigation more efficient and more complete. 


Objective 
16.1.2 The objective of the investigation of human factors in occurrences is to advance aviation safety by: 


a) determining how breakdowns in human performance may have caused or contributed to the 
occurrence; 


b) identifying safety hazards as they relate to limitations in human performance; and 


c) making recommendations designed to eliminate or reduce the consequences of faulty actions or 
decisions made by any individual or groups involved in the occurrence. 


Scope 


16.1.3 To achieve such an objective, the collection and analysis of human factors information should be as 
methodical and complete as any other traditional area of the investigation, a requirement that forces the investigation 
beyond the examination of the actions of the aircrew to include an analysis of any individual or group involved in the 
occurrence, be it management, the regulator, or the manufacturer. 


16.1.4 In a complex, interactive and well-guarded transportation system such as the aviation industry, accidents 
rarely originate from actions or non-actions of the front-line operators alone; accidents result from the interaction of a 
series of latent factors already in the system. In almost every facet of an investigation, from management and 
supervisory decisions to maintenance activities and pilot performance, one can identify human performance factors that 
may help to explain the causal event sequence. An investigation that focuses on only the front line operators acts as a 
barrier to the identification of systemic safety hazards and the opportunity to eliminate or reduce the consequence of 
safety hazards through the making of recommendations. 
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Overview 


16.1.5 This chapter provides guidelines on the integration of the human factors investigation with the overall 
investigation. The guidelines are equally applicable to the investigation by a single investigator responsible for all 
aspects of the investigation, as they are to the investigation where one or more investigators are dedicated solely to the 
human factors aspects of the investigation. 


16.2 ASYSTEMS APPROACH TO THE INVESTIGATION OF HUMAN FACTORS 


Human factors frameworks 


16.2.1 In general, the human factors data that must be collected fall into two broad areas: information which will 
enable investigators to construct a detailed chronology of each significant event known to have occurred prior to and, if 
appropriate, following the occurrence (this chronology must place particular emphasis on the behavioural events, and 
what effect they may have had on the accident events sequence); and contextual information which will permit 
investigators to explain why the behaviour actually happened. 


16.2.2 The human element can become involved in occurrences in three ways. The first way is as a direct 
contributor through an unsafe act. Generally, this tends to be an active failure by an operator at the scene of the 
occurrence and is often referred to as “operator, user or pilot error’. The second way, which also results in direct 
involvement, is as a receiver/user of unsafe conditions. The third way is an indirect contributor to either unsafe acts or 
conditions through an antecedent unsafe act or latent failure. This final manner of involvement emphasizes the 
interrelationships or linkages between unsafe acts and conditions and, therefore, underscores the need to consider 
various layers of underlying causes and contributing factors. 


16.2.3 Following is a description of four frameworks - the SHEL model, Reason’s Model of Accident Causation, a 
Latent Unsafe Conditions Framework (LUC), and a Behaviour and Error Framework that will aid the investigator in 
gathering and analyzing relevant occurrence information to determine the various layers of underlying causes and 
contributing factors. Subsequent to the description of the four frameworks is a description of an investigative tool, the 
Integrated Process for Investigating Human Factors, which integrates the four frameworks into an investigative step-by- 
step process. 


SHEL 


16.2.4 The SHEL model (Figure IIl-16-1), originally developed by Edwards (1972) and modified by Hawkins 
(1987), facilitates a systematic approach to data collection. Each component of the SHEL model (software, hardware, 
environment, and liveware) represents one of the building blocks of human factors studies. 


16.2.5 The liveware, or the human element, is the centerpiece of the model, representing the most critical and 
flexible component. The person represented by this component could be any person involved with the operation of a 
flight, and thus the component should not be considered restricted to aircrew. Each person within this central component 
brings his or her own limitations and strengths, be they physical, physiological, psychological, or psychosocial. 


16.2.6 The central human component does not act on its own; it interacts directly with each of the others. The 
edges of this human block are not simple and straight, so other blocks must be carefully matched to them if stress and 
eventual breakdown (an accident) are to be avoided. The investigation of human factors must identify where 
mismatches between components existed and contributed to the occurrence, and so the data collected during the 
investigation should permit a thorough examination and analysis of each of the SHEL components and its interactions 
with the central component. 
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a) 


qd) 


Liveware-Hardware (Human-Machine). This interaction includes any physical or mental interactions 
between the human and the machine, design limitations and peculiarities in work-station configuration. 


Liveware-Software (Human-System). This interaction concerns the nature of the information transfer 
between the human and supporting systems such as checklists, manuals, training, procedures, and 
regulations. 


Liveware-Environment (Human-Environment). This interaction subdivides into two areas: 


1) Internal: personal comfort and physical working conditions. 
2) External: weather, aerodrome surroundings and infrastructure. 


Liveware-Liveware (Between People). This interaction explores the nature of human interactions and 
communication breakdowns between individuals. 


Note.— To facilitate its use, the SHEL model has been expanded in the form of human factors data 
gathering guidelines in 16.3.4 and 16.3.5. 





S = Software (procedures, In this model the match or 
symbology, etc. mismatch of the blocks (interface) 
Hardware (machine) is just as important as the 
Environment characteristics of the blocks 

L = Liveware (human) themselves. A mismatch can be 

a source of human error. 


H= 
E= 





Figure Ill-16-1. The SHEL model (adapted from Hawkins, 1975) 
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Reason’s model of accident causation 


16.2.7 A framework proposed by James Reason (1990) explains how humans contribute to the breakdown of 
complex, interactive, and well-guarded systems such as the aviation industry. In such a system, accidents rarely 
originate from active failures or unsafe acts of front-line operators alone. According to Reason, accidents result from the 
interaction of a series of flaws, or latent failures, already present in the system (Figure III-16-2). 


16.2.8 The two types of failures, active and latent depend upon the immediacy of their consequences. An active 
failure is an error or violation which has an immediate adverse effect. Active errors are usually made by the front-line 
operator. A pilot raising the landing gear lever instead of the flap lever exemplifies this failure type. A latent failure is a 
result of a decision or an action made well before an accident, the negative consequences of which may lie dormant for 
a long time. These failures usually originate at the decision-maker, regulator, or line management level, that is, people 
far removed in time and space from the event. A decision to merge two companies without providing training to 
standardize operating procedures illustrates the latent failure. These failures can also be introduced at any level of the 
system by the human condition — such as policies that lead to poor motivation or fatigue. 


16.2.9 Latent failures, which originate from questionable decisions or incorrect actions, although not harmful if 
they occur in isolation, can interact to create a “window of opportunity” for a pilot, an air traffic controller, or mechanic to 
commit an active failure which breaches all the defenses of the system and results in an accident. The front-line 
operators are the inheritors of a system’s defects. They are the ones dealing with a situation in which technical problems, 
adverse conditions, or their own actions will reveal the latent failures present in a system. In a well-guarded system, 
latent and active failures will interact, but they will not often breach the defenses. When the defenses work, the result is 
a minor event or at most an incident; when they do not, it is an accident. 


a) Upper management decisions. Amongst these latent failures are decisions made by upper 
management, an aviation company’s corporate managers or regulatory officials. When allocating 
resources, management has to balance, among other things, safety against cost. These objectives 
can conflict and may result in flawed decisions which will be reflected throughout the system. 


b) Line management deficiencies. Managerial decisions, including those that are flawed, have to be 
implemented by line management through their standard operating procedures, training programmes, 
flight and crew scheduling, etc. If deficiencies also exist at this level, they will increase the accident 
potential of those managerial decisions; for example, dispatch who has inadequate appreciation for 
operational conditions may jeopardize safety by trying to follow a policy which is not appropriate for 
the situation. 


c) Existing preconditions. \f certain characteristics or preconditions, such as an unproductive 
environment, poorly motivated or unhealthy workforce, machines in a poor working state, and poorly- 
established procedures are present in the system, they will influence the front line operation’s actions 
and become a source of unsafe acts. 


d) Latent failures. Flawed decisions at the managerial levels, line management deficiencies, and existing 
preconditions at the worker level represent the system’s latent failures. 


e) Unsafe acts. Unsafe acts take many forms and, because of error, can never be totally eliminated. 


f) Defenses. In a complex and well-guarded system, these latent failures may lie dormant for a long time 
without having significant impact on safety because very effective defenses, such as checks, 
procedures or GPWS, allow for a great number of these flaws to be simultaneously present in the 
system without serious consequences. 
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g) Window of opportunity. An accident trajectory occurs when unsafe acts interact with latent failures 
present in the system and breach all the system defenses, thus creating a “Window of opportunity” for 
an accident to occur. 


h) Summary. Many unsafe acts are committed without consequence because existing conditions did not 
favour an interaction of all the deficiencies present in the system. Investigators, therefore, should not 
only examine unsafe acts made by front-line operators, but should work their way from unsafe acts 
and inadequate or removed defenses, through the accident trajectory, all the way back to upper- 
management levels. Addressing the higher levels’ deficiencies, in addition to the ones closely related 
to the unsafe acts, allows the investigator to formulate preventive measures which will affect a larger 
set of occurrences. 
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Figure Ill-16-2. Reason’s model 
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Latent Unsafe Conditions (LUC) framework 


16.2.10 The LUC framework is an extension of the Reason model, with an emphasis on a systematic means for 
examining personal and organizational factors. This framework comprises the elements of the SHEL model within the 
Reason concept of latency. Latent unsafe conditions include all those latent factors in the transportation system which 
can adversely affect safe operations or maintenance. They include latent factors at both the personal and the 
organizational level and may be referred to as LUC factors. It should be noted that an element of chance is involved in 
occurrences in the sense that operations may be conducted year after year under the same unsafe conditions without 
consequence; however, on any given day, an additional element of “bad luck” is added to the equation and tragedy 
results. Hence, the abbreviation LUC is a reminder of this element of chance. 


16.2.11 Personal latent unsafe conditions (P-LUC factors) include those factors such as the state of mind of the 
individual, physical well being, etc.; such factors can adversely affect the safety of operations or maintenance activities. 
Similarly there are organizational latent unsafe conditions (O-LUC factors); i.e. those factors beyond the purview of the 
individual which have the potential for adversely affecting personal or team performance in operations or maintenance. 


Personal LUC factors 


16.2.12 Latent unsafe conditions at the personal level are known as P-LUC factors. These factors may limit or 
degrade an individual's expected performance, resulting in an error of some type. The potentially adverse effects of 
P-LUC factors may be amenable to mitigation by the individual or by the organization, if they are identified in time. Aside 
from collecting the facts at the individual level, it may be difficult for the transportation system to address “personal” 
problems. However, sometimes a P-LUC factor will be indicative of a more systemic Organizational LUC factor, which is 
conducive to broad remediation. P-LUC and O-LUC factors are illustrated within the Reason framework in Figure III-16-3. 


16.2.13 The P-LUC factors are sometimes referred to as the physical, physiological, psychological, and 
psychosocial factors. Further discussion of the type of information that should be considered under P-LUC factors can 
be found under 16.3.5, Data Gathering Guidelines, Liveware — The Individual. 

Organizational LUC factors 

16.2.14 Latent unsafe conditions at the organizational and management level are known as O-LUC factors. 
Company management practices, the regulatory climate, and even the attitudes of workers fostered by professional 
associations can adversely affect human performance in both operations and maintenance. Following are some of the 
principal O-LUC factors; the types of information investigators should consider under each of these factors is discussed 
in more detail in 16.3.5, Data Gathering Guidelines, Liveware-Liveware, Liveware-Hardware, etc. 


a) Design: 


1) Poor technical design of equipment, including inadequate consideration of the human/machine 
interface requirements for avoiding human error. 


2) Poor task design, failing to take into account all the SHEL model interfaces. 
b) Personnel: 


1) Inadequacies in the initial (and ongoing) selection of personnel with the requisite knowledge, skills 
and attitudes for safe and efficient job performance. 


2) Deficiencies in the knowledge and skills of employees which are necessary for them to do their 
jobs safely, resulting from training inadequacies. 


Part Ill. Investigation 
Chapter 16. Investigating Human Factors III-16-7 








Figure Ill-16-3. Latent unsafe conditions within the Reason framework 


3) Scheduling practices for operating or maintenance personnel which may compromise individual or 
team performance. 


4) Inadequacies in personnel monitoring and support programmes to ensure the continuing fitness of 
employees for their specified duties. 


5) Remuneration practices which provide employees with incentives to cut corners. 
Procedures and accepted operating practices: 


1) Company-prescribed procedures which are difficult to follow, ambiguous, incomplete, incorrect, 
inaccessible or absent. 


2) Accepted operating or maintenance practices which differ from prescribed procedures and create 
conditions that might lead to errors. 


Communications: 


1) Information necessary for safe and effective operations and maintenance is not sent, received or 
understood by the intended recipients in a clear, unambiguous and intelligible form. 


Organization: 


1) Deficiencies in the operating philosophy and policies of the organization which create error- 
conducive conditions. 


2) Incompatible organizational goals in that production goals are in conflict with the maintenance of a 
safe operating environment. 
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16.2.15 


Deficiencies in either the structure of the organization or its way of conducting business which 
inhibit effective internal communications between management and operations or maintenance. 


Deficiencies in the organization’s safety climate which allow safety responsibilities to be ill-defined 
and warning signs to be overlooked. 


Work environment: 


1) 


Conditions conducive to committing unsafe acts or making safety related errors due to physical 
conditions in the workplace which influence individual or team performance. 


Regulatory overview: 


Deficiencies in the rules and regulations governing transportation operations and maintenance. 
Deficiencies in the certification of equipment, personnel and/or procedures. 


Deficiencies in the surveillance, audit and inspection of transportation operations and 
maintenance. 


Associations and unions: 


1) 


Philosophies, policies, or practices which create conditions conducive to human error and unsafe 
acts. 


Defenses: 


1) 


4) 


Deficiencies in the identification and dissemination of known risks and how to manage them; i.e. 
safety awareness. 


Deficiencies in providing personnel with adequate detection and warning systems to see an 
unsafe event unfolding in time to prevent it. 


Deficiencies in the system's ‘error tolerance’ such that recovery from an unsafe condition is 
difficult without sustaining injury or damage. 


Deficiencies in the emergency response capabilities of the system which aggravate the 
consequences of an accident. 


These Latent Unsafe Conditions in organization and management provide the operational context for 
human errors by operators and maintainers. Each LUC factor represents a potential hazard which can be systematically 
identified, validated, and corrected. 


Behaviour and error framework 


16.2.16 


The following is a description of modes of behaviour, human error, and the interaction between behaviour 
and error. The behaviour/error framework has been adapted primarily from Rasmussen’s (1987) taxonomy of behaviours 
and Reason’s (1990) generic error-modeling system (GEMS) framework which facilitates the linkage of an error to an 
individual's level of performance (i.e. behaviour) at the time the failure occurred. 
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Modes of behaviour 


16.2.17 To understand the ways in which people err, it is necessary to first look at the ways in which they behave. 
Rasmussen (1987) has identified a taxonomy of behaviours which provides a description of performance based on three 
different levels of decision-making. The following are descriptions of these three performance levels. 


a) Skill-based performance describes behaviour for a person engaged in a well-learned activity. Actions 
tend to be based on stored routines; skill-based performance is largely an automatic response where 
there is little, if any, conscious decision-making; 


b) Rule-based performance is less automatic. Decisions are based on learned procedures; these 
procedures are stored in long-term memory and require the involvement of the central decision maker 
and working memory because rule-based behaviours are actioned at the conscious level. Response is 
governed by an “if-then” algorithm, such as “if this is the situation, then this is the diagnosis; if this is 
the diagnosis, then this is the remedial action”; and, 


c) Knowledge-based performance is behaviour that arises when an operator is faced with novel 
situations for which there are few pre-established rules, but which require that appropriate action be 
taken. Without rules to guide, decisions are based on the operator’s knowledge and experience. 


Having categorized behaviour using the skill-rule-knowledge-based taxonomy, one can examine how people fail while 
operating within the behavioural modes. 


Human error 


16.2.18 There are two distinct categories of error, those actions that deviate from intention or are unintended (i.e. 
actions that do not proceed as planned) and those that are intended (i.e. actions that proceed as planned, but they fail to 
achieve the desired consequences). Errors can be further broken down into types, and the type depends largely on 
examining the concept of intended action. It is important to note that the criteria of “intentionality” refers to the action 
itself and not the intention to err. 


a) Unintended actions. “Was the action that was carried out, the action that was planned?” If the answer 
to that question is no, then an unintentional action occurred. An unintentional action resulting in an 
error arises from a failure in the execution of the action in that there was a difference between what 
action was supposed to have occurred and what action actually did. An error in execution is either a 
slip or a lapse. 


Slips usually arise as the result of not paying sufficient attention to the execution of the action. For 
example, an operator reaches for a switch, without looking, and places the control in the “OFF” 
position from the “STANDBY” position, when the intent was to place the switch control in the “ON” 
position. 


A lapse is an unintentional action where there is a memory failure. For example, a person following a 
series of instructions may forget one of the steps involved in a task. 


Whether the error is a slip or a lapse, the planned action is the correct action for the situation; 
however, the operator fails to execute the action properly. 
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b) Intended actions. “Was the action that was carried out, the action that was planned?” If the answer to 
that question is yes, then it is an intended action. An intentional action resulting in an error or violation 
involves a failure in planning in that the intended action was inappropriate. An error in planning is 
either a mistake or a violation. With this error type, the action proceeds exactly as planned but fails to 
achieve the desired consequences; in other words, the error is in the planning — it is the incorrect 
action for the situation. Mistakes are often failures of thought and of the decision-making process. 
They are usually more subtle than slips and lapses and considerable time can pass between the 
execution of the erroneous action and its detection. 


Mistakes, where there is no desire to do the wrong thing, can be distinguished from a violation where 
a deliberate decision to act against a rule or plan has been made. The term violation denotes a 
calculated adjustment or modification of a rule or plan which differentiates it from the basic error types 
as defined by the slip, lapse and mistake. 


16.2.19 Despite the deliberate actions, some violations (i.e. routine and exceptional violations) involve people 
trying to “do the right thing” and differ from sabotage where there is malicious purpose. Routine violations occur every 
day as people regularly modify or do not strictly comply with work procedures, often because of poorly designed or 
defined work practices. In contrast, an exceptional violation tends to be a one-time breach of a work practice, such as at 
Chernobyl where safety regulations were deliberately ignored in order to carry out a safety test. However, the goal was 
not to commit a malicious act, but actually to improve system safety. 


Behaviour/error framework 


16.2.20 Reason’s GEMS (1990) provides a framework that combines Rasmussen’s skill-rule-knowledge-based 
behaviour taxonomy with the basic human error types, the result of which yields the following: 


1) skill-based slips and lapses; 
2) rule-based mistakes; and 
3) knowledge-based mistakes. 


An argument has been forwarded that violations are typically rule-based and only sometimes knowledge-based 
(Glendon and McKenna, 1995). However since an assessment or evaluation of information (e.g. a rule or plan) is 
associated with a violation, this type of failure would appear to occur most often at the knowledge-based level of 
performance (Hudson, 1991). 


a) Skill-based slips and lapses. lf the error involves skill-based performance, then a slip or a lapse would 
have occurred due to either inattention or overattention. Inattention is the failure to make a necessary 
attentional check on progress; overattention involves making the attentional check, but at an 
inappropriate time in the action sequence. Inattention may result from something as simple as an 
interruption; in that case, the operator omits the required check because he or she is interrupted or 
distracted by some external event, such as a radio call interrupting a checklist procedure, resulting in 
the operator’s missing one of the checks. Overattention may also result in an omission. Should the 
operator believe that the action sequence is further along than it actually is, a necessary step in the 
sequence can be omitted. A list of specific failure modes by behavioural groupings was derived from a 
number of reference sources (Norman, 1981; Norman, 1988; Weiner and Nagel, 1988; Reason, 1990) 
and a description of each can be found in Appendix 1 to Chapter 16. 


Part Ill. Investigation 
Chapter 16. Investigating Human Factors II-16-11 





b) 


Rule-based mistakes. If the error involves rule-based performance, then a mistake occurred because 
either a bad rule was applied or a good rule was misapplied. A bad rule is one that is either incorrect, 
ineffective or inadvisable (refer to Appendix 1 to Chapter 16 for further discussion of failure modes at 
the rule-based level). A good rule is one that has proven to be useful under given circumstances. An 
error involving a misapplication of a good rule is one where the applied rule is no longer appropriate 
for the particular circumstances. (See Appendix 1 to Chapter 16 for examples of failure modes at the 
rule-based level.) 


Knowledge-based mistakes. When no rules apply to a given situation, new solutions or plans must be 
formulated (Hudson, 1991). An error, that is a mistake, that occurs during the formulation of the 
solutions or plans falls within knowledge-based performance. These errors occur because the 
operator is without all the information required to form an accurate mental model of the problem 
space. Failure modes at this level can arise from biases such as confirmation bias where the operator 
seeks information that will confirm what he or she already believes to be true and discounts 
information that is inconsistent with the chosen hypothesis. (See Appendix 1 to Chapter 16 for 
examples of failure modes at the knowledge-based level.) 


An Integrated Process for Investigating Human Factors 


16.2.21 The work systems/organization and human error/behaviour frameworks, described in 16.2.1 to 16.2.20 
provide investigators with a focus on the potential unsafe conditions that an investigation of human factors strives to 
uncover. The following is a process that integrates those frameworks into a step-by-step systematic approach for use in 
the investigation of human factors. Refer to Appendix 2 to Chapter 16 for greater detail of each step in the process. 


16.2.22 The process can be applied to both types of occurrences, i.e. accidents and incidents. Illustrated in 
Figure IIIl-16-4, the process consists of seven steps: 


1) 
2) 


3) 


collect occurrence data; 
determine occurrence sequence; and 


identify unsafe acts (decisions) and unsafe conditions’; 


and then for each unsafe act (decision), 


identify the error type or adaptation; 
identify the failure mode; 
identify behavioural antecedents; and, 


identify potential safety problems. 


Steps 3 to 6 are useful to the investigation because they facilitate the identification of latent unsafe conditions. Step 7, 
the identification of potential safety problems is based extensively on what factors were identified as behavioural 


antecedents. 





1. At times, an unsafe condition may be a result of a natural occurrence. At other times, an unsafe act or decision may result from an 
unsafe condition which itself was established by a fallible decision. In the former case, the investigator may jump from Step 3 to 
Step 7; in the latter case, the investigator should proceed through Steps 3 to 7. 


Manual of Aircraft Accident and Incident Investigation 





Il-16-12 


SOLLSRINAH 





109 S800 UENO 





suOIpLog syesun wstes 





‘Suoq eu aygcun Wai) 


saToa avd 40 S aur Ie d anni 
NOILVOITddv¥ i = SUOHIDUDS 


een sumed 
WOE] BeANIT 


SIW3180ud 
ALBAVS SIN3Q3931NV 


WILNSLOd TWHYNOIAVHAS 


$aTna dood 40 
NOLLVOITdd¥sIv 






NOLINALLVAIAO 1] NOLLOV G9aNALNINO 


NOLIN@LLVNI aire, rf 
asva-TILAs i suaKL 


WOW OISVA 
1 I Ajuneddo weprooy 


oe eet JO ero PLT 
SNOTLIGNOD 
aIvsNn 


SNOLLIGNOS 
— aa¥SNn 
SWaTaOdd SLN3Q303LNY s3qow aioe 
Alaavs NOLLW0IA aONaNbaS viva 


quapinsay 


ld 


TWILNALOd YO YOMNS 
ASILNaII AuNea Naa SUNS SueeSGaISy SNINYSLA0 1937109 


SavsNnn 
ASILNAOI 





€ dls 


Integrated process for occurrence investigation 


Figure IIl-16-4. 


Part Ill. Investigation 
Chapter 16. Investigating Human Factors III-16-13 





Step 1 - Collect occurrence data 


The first step in the human factors investigation process is the collection of work-related information regarding the 
personnel, tasks, equipment, and environmental conditions involved in the occurrence. 


For complex systems, where there are numerous interactions between the component elements, there is constant 
danger that critical information will be overlooked or lost during an investigation. Use of the SHEL model as an 
organizational tool for the investigator's workplace data collections helps avoid problems downstream because: 


a) it takes into consideration all the important work system elements; 
b) it promotes the consideration of the interrelationships between the work system elements; and 


c) it focuses on the factors that influence human performance by relating all peripheral elements to the 
central liveware element. 


Figure III-16-5. is an adapted illustration of how this model can be applied to a complex system where multiple liveware, 
hardware, software and environmental elements exist. 


Step 2 - Determine occurrence sequence 


As the investigator moves to addressing questions of “how and why”, there is a need to link the events and 
circumstances identified in the first step of the process. Reason’s (1990) model of accident causation, utilizing a 
production framework, can be used by an investigator as a guide to developing an occurrence sequence. As well, 
Reason’s model facilitates further organization of the work system data collected using the SHEL model, and an 
improved understanding of their influence on human performance. The occurrence sequence is developed by arranging 
the information regarding occurrence events and circumstances around one of five production elements, i.e. decision 
makers, line management, preconditions, productive activities, and defenses. 


These production elements themselves are basically aligned in a temporal context. This temporal aspect is an important 
organizing factor since the events and circumstances that can lead to an accident or incident (and would therefore be 
causal factors) are not necessarily proximate in time, nor in location, to the site of the occurrence. By establishing a 
sequential ordering of the causal data, Reason’s (1990) concept of active versus latent factors is introduced (refer to 
16.2.7 to 16.2.9). 


In practice, Steps 1 and 2 may not be mutually exclusive. To facilitate this concurrent activity, the SHEL and Reason 
models can be combined as illustrated in Figure Ill-16-6. 


Step 3 - Unsafe acts/decisions and conditions 


In Step 3 of the process, the investigation and/or analysis is simplified where the information gathered and organized 
using the SHEL, Reason, and LUC frameworks is used to initiate identification of unsafe acts/decisions and conditions. 
There may be several acts, decisions and/or conditions which are potential unsafe candidates, thus necessitating 
iterative assessments of the occurrence facts. The SHEL and Reason hybrid model (refer to Figure Ill-16-6) can provide 
a useful base for conducting such iterative assessments. 


When an unsafe act, decision or condition is identified, the focus shifts to determining the genesis of that particular act. 
Further investigation and/or analysis may reveal other unsafe acts/decisions or conditions antecedent to the causal 
factor that was initially identified. 
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Figure Ill-16-5. Modified SHEL Model 
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Figure Ill-16-6. SHEL and Reason hybrid model 
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The last unsafe act precipitating the occurrence often provides a convenient starting point for reconstruction of the 
occurrence. 


For example: Following Steps 1 and 2, an investigator determines that one of the unsafe acts was the failure to complete 
a checklist item. 


Note.— This example will be used and built upon throughout this section to illustrate the process. 


The data collected during an investigation (i.e. events and circumstances) can be organized, using multiple components 
of the modified SHEL model, into a framework surrounding an occurrence template (in this case the accident scenario), 
based upon the Reason model. In this way, each occurrence can be described by a unique framework of events and 
circumstances, the investigator being interested in identifying those which constitute the occurrence’s unsafe 
acts/decisions and conditions. 


Step 4 - Identify error or violation type 


Step 4 is initiated for each unsafe act/decision by posing the simple question, “What is erroneous or wrong about the 
action or decision that eventually made it unsafe?” (Refer to 16.2.8 for elaboration of the terms used throughout this 
step.) 


The identification of the type of error or violation involves two substeps. (See Figure II|-16-7.) 


1) Unintended or intended action. First, determine whether the error or violation was an unintended or 
intended action. 


2) Error type or violation. The second substep is the selection of error type or violation that best 
describes the failure, keeping in mind the decision regarding intentionality. There are four potential 
error/adaptation categories, i.e. slip, lapse, mistake and violation. 


For example: Continuing with the unsafe act described above, the investigator determines that the 
unsafe act of not completing a checklist item was unintentional and that it was due to a slip because 
the operator did not attend to a step in the sequence. 


Step 5 - Identify failure modes 


In Step 5, the focus is now placed on the decision that eventually led to the erroneous action or decision identified in 
Step 3. This is accomplished by placing the errors (slips, lapses and mistakes) and violations into the context of 
performance (behaviour), i.e. how was one performing at the time of the failure? 


The GEMS (Generic Error Modeling System) framework facilitates the linkage of an error/violation to an individual's level 
of performance at the time the failure occurred. By following through to the next step (refer to Figure Ill-16-8), one can 
begin to understand how errors and violations can have their roots in common behavioural failure patterns (i.e. failure 
modes) and are not necessarily the result of irrational behaviour. 
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Figure Ill-16-7. The GEMS Framework (adapted from Reason, 1990) 


Recalling from 16.2.16 to 16.2.20, the error types and violations are matched against three categories of behaviour, 
resulting in the following: 


1) skill-based slips and lapses; 
2) rule-based mistakes; and 
3) knowledge-based mistakes. 


Within each level of performance (i.e. behavioural category), there are different ways or modes a failure can occur (refer 
to Figure Ill-16-8 for general descriptions of these failure modes). The errors and violations identified in Step 4 can be 
related to the failure modes as demonstrated by following a given pathway from Figure III-16-7 to Figure III-16-8. 


For example: Having determined that the unsafe act of not completing a checklist item was unintentional and the error 
type was a slip, the investigator matches the error type to the performance level and determines that the operator was in 
skill-based behaviour. The failure modes that occur in skill-based behaviour are listed in Appendix 1 to Chapter 16. In 
the example, the investigator, having pieced together the accident scenario, knows that, while carrying out the checklist 
procedure, the pilot was contacted by ATC and given a departure clearance. The investigator then identifies that one of 
the failure modes at the skill-based level is omission following interruption which is characterized by a required check 
being interrupted by some external event. In this failure mode, the original action sequence, i.e. carrying out the checklist 
procedure, continues, but with one or more of the items omitted. In the case of the example, the two tasks, monitoring 
the checklist and copying out the departure clearance, competed for the same attentional resources and checklist 
monitoring suffered. 
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Breakdown of behaviour into failure modes 
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Step 6 - Identify behavioural antecedents 


In Step 5, the focus was placed on the identification of failure modes which described erroneous decision-making or 
unsafe acts. To uncover the underlying causes and contributing factors behind the decision of an individual or group, it is 
important to determine if there were any factors in the work system that may have facilitated the expression of the given 
failure mode (and hence the error/violation and the unsafe act). These factors have been termed behavioural 
antecedents. The behavioural antecedents can be found by examining the work system information collected and 
organized using the SHEL, Reason, or LUC frameworks in Steps 1 and 2. The re-examination of these data again 
emphasizes the iterative nature of this investigative process where it may even be deemed necessary to conduct further 
investigations into the occurrence. 


The three performance or behaviour levels can be broken down into common behavioural failure patterns or modes of 
failure. Descriptions of these failure modes are provided in Appendix 1 to Chapter 16. 


For example: In re-examining the data gathered, the investigator discovers one of the behavioural antecedents is the 
design of the checklist itself. The checklist is paper; there are no aids incorporated into the checklist that will enable the 
pilot to keep track of the checklist sequence. In the absence of such aids, the onus is on the pilot to ensure that an item 
is not missed. By identifying the design of the checklist as problematic, the investigator has uncovered a latent unsafe 
condition in the system. Such latent unsafe conditions in organization and management are the behavioural antecedents 
to unsafe acts and decisions by operators and maintainers. They represent potential hazards which can be 
systematically identified, validated and corrected. 


Step 7 - Identify potential safety problems 


At Step 7, the investigator flags those unsafe latent conditions that occurred naturally or those that occurred as a result 
of a fallible decision as potential safety problems. For the most part, the identification of potential safety problems is 
based extensively on what factors were identified as behavioural antecedents. Once again this underscores the 
importance of the application of a systematic approach to Steps 1 and 2 of the process which sets the foundation for the 
subsequent analysis steps. 


Where appropriate, the potential safety problems can be further analyzed to identify safety deficiencies and 
recommendations for safety actions. 


Summary 


The Integrated Process for Investigating Human Factors was developed as a tool to be use by investigators and 
analysts to facilitate the identification of direct and underlying unsafe conditions in transportation occurrences. The 
frameworks, which provide the foundation for the process, were drawn from the human factors literature since the 
human element has been identified as a significant contributor to occurrences. The final step of the process is the 
identification of potential safety problems which, in turn, may be used to identify systemic safety deficiencies. 


16.3 INVESTIGATIVE ACTIVITIES 


Gathering information 


16.3.1 The success of the human factors investigation depends largely on the quantity and quality of the 
information collected. As each occurrence is different from the other, the investigator will need to determine the type and 
quality of data to be collected and reviewed. As a rule, the investigator should be over-inclusive in gathering information 
initially and eliminate superfluous data as the investigation unfolds. 
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16.3.2 Use the SHEL conceptual model previously described as a tool to orient the data collection phase. In 
general, collect facts that will allow you to: 


a) construct a history of all significant behavioural events known to have occurred; 


b) thoroughly examine and analyse the SHEL interfaces to determine if and where breakdowns existed; 


c) determine what might have influenced or motivated a particular action, of all persons involved in the 
occurrence; and 


d) fully support the existence of an identified safety deficiency. 


Sources of information 


16.3.3 Information relevant to an aviation occurrence can be acquired from a variety of sources. Primary sources 
relating specifically to human factors include hardware evidence, paper documentation, audio and flight recorder tapes, 
interviews, direct observation of aviation personnel activities and simulations. Secondary sources include aviation 
occurrence data bases, reference literature and human factors professionals and specialists. 


a) Primary sources 


1) 


Hardware evidence is most often associated with the aircraft but may also involve other work 
stations and equipment used by aviation personnel (e.g. air traffic controllers, flight attendants, 
aircraft maintenance and servicing personnel). Specific sources include aircraft wreckage, 
similarly configured aircraft, manufacturer's data, company records and logs, maintenance and 
servicing equipment, air traffic control facilities and equipment, etc. 


Paper documentation spans the complete spectrum of SHEL interfaces. Consider the following 
list of documents: 


Personal records and logbooks; 

Certificates and licences; 

Company personnel and training records; 

Aircraft flight manuals; 

Company manuals and standard operating procedures; 
Training manuals and syllabi; 

Company training and operational schedules; 
Regulatory authority records; 

Weather forecasts, records, and briefing material; 
Flight planning documents; 

Medical records; and 

Medical and post-mortem examinations. 
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3) 


Flight data recordings and ATC radar tapes are valuable sources of information for determining 
the sequence of events and examining the liveware-liveware interfaces. Within airlines using flight 
recorder monitoring programs, there can be a wealth of information about crew's normal operating 
procedures. In addition to traditional flight data recordings, new generation aircraft have 
maintenance recorders and some electronic components with non-volatile memories that are also 
potential sources of information. Audio (ATC and CVR) recordings are invaluable sources of 
information about the liveware-liveware and liveware-hardware interfaces. In addition to 
preserving personnel communications, audio recordings can also provide evidence on the state of 
mind of individuals, and possible stress or fatigue. It is essential, therefore, that persons familiar 
with the crew listen to the recordings to confirm the identity of the speaker and to indicate any 
anomalies in speech pattern or style. It is also essential that individuals knowledgeable about the 
specific crew operating procedures listen to the recordings to provide a more complete picture of 
crew activities that are non-verbal. 


Interviews conducted with individuals both directly and indirectly involved in the occurrence are 
also important. 


Consider the following persons to interview: 


Flight crew 
Other crew members 
Air traffic controllers 


Ground handlers 
Weather briefers 
De-icing personnel 


Company owner 
Chief pilot 

Instructors 

Other company pilots 
Supervisors 


Chief of maintenance 
Technical specialists 


Flight test examiners 
Auditors 


Physician 
Aeromedical examiner 
Friends 


Flight attendants 
Passengers 
Eyewitnesses 


Dispatchers 
Baggage handlers 
Aircraft maintenance engineers 


V.P. flight operations 
Chief instructor 
Check pilot 

Former employers 


Maintenance engineers 
Airworthiness inspectors 
Other regulatory authorities 
Psychologist 


Co-workers 
Family members 


Knowledge gleaned from such interviews can be used to confirm, clarify, or supplement data from 
other sources. In the absence of measurable data, interviews become the single source of information, 
and investigators therefore need to be skilled on interview techniques. Guidelines on interview 
techniques are contained in Appendix 2 of ICAO Human Factors Digest No. 7 (Cir 240), Investigation 
of Human Factors in Accidents and Incidents. 
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b) Secondary sources 


1) 


3) 


Not all human factors factual information is gathered in the field. After the field phase of the 
investigation, additional information about human factors may be collected, facilitating analysis of 
the factual information collected in the field. These secondary data come from several sources. 


Direct observations of actions performed in the real environment can reveal important information 
about human factors. Observations can be made of the following: 


Flight operations activities 
Flight training activities 
Maintenance activities 

Air Traffic Control activities 


Simulations permit reconstruction of the occurrence and can facilitate a better understanding of 
the sequence of events which led up to it, and of the context within which involved personnel 
perceived the events. 


Computer simulation can be used to reconstruct events by using data from the flight recorders, air 
traffic control tapes, and other physical evidence. 


Often a session in an aircraft flight simulator or reconstruction of a flight in a similar aircraft can 
offer valuable insights into the circumstances that led to an occurrence. Participation in 
simulations by personnel involved in the occurrence events can trigger recollection of important 
information which would otherwise not come to light. 


Aviation safety databases containing accident/incident data or confidential reporting systems and 
databases maintained by some aircraft manufacturers are useful sources of information directly 
related to the aviation operational environment. Examples are ADREP (ICAO), STEADS (IATA), 
CASRP (Canada), ASRS, and ASIS (United States), CAIRS (Australia), CHIRP (United 
Kingdom). 


Investigators should use databases with caution, however, being sure to know its source and 
target populations as well as its limitations. They should be familiar with the vocabulary used in a 
specific database, as no single set of key words is common to all databases. Coding and data 
entry criteria differ between various databases, which may affect the meaning of retrieved data. 
Appendix 4 of ICAO Human Factors Digest No. 7 (Cir 240), Investigation of Human Factors in 
Accidents and Incidents provides a more detailed discussion of databases and their application to 
the investigation of human factors. 


Literature reviews can be an important source of information. Consulting reference material can 
help to do the following: 


i) Identify how a given human factor may affect performance; 


ii) Relate the information found in the field to what is known of human behaviour in similar 
circumstances; and 


iii) Organize the information gathered in the field in a logical way. 
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9) It should be noted that basic psychological and sociological references can be good sources of 
information about general human performance, but they seldom address human behaviour in 
conditions comparable to the aviation operational environment. In recent years, professionals in 
the human factors field have provided some valuable material addressing aviation operational 
issues. Some aviation research agencies will, on request, provide literature review services on 
selected topics. Additional references can be found in ICAO Human Factors Digest No. 7 
(Circular 240). 


10) At any time during an investigation, investigators must be willing to consult professionals outside 
their area of expertise. These professionals include, but are not restricted to, the following: 


i) Medical officers — to analyze the impact of any medical condition found in the flight crew or 
other relevant personnel; 


ii) Psychologists — to analyze the impact of environmental, operational, and situational factors 
on motivation and behaviour; 


iii) Sociologists — to evaluate the factors that affect interactions and performance; 

iv) Sleep researchers and professionals — to evaluate the quality of rest available to the 
individual, and the impact on performance of a particular work-rest duty cycle or of circadian 
factors; and 

v) Ergonomists — to assess the effect of design and layout on the user. 


Data gathering guidelines 


16.3.4 The following data gathering guidelines on the gathering of Human Performance information are based on the 
SHEL and LUC frameworks. These guidelines were designed to offer: 


a) some suggestions on how performance can be altered by these factors; and 
b) some guidance on areas to examine for sources of evidence. 


16.3.5 The following description of the SHEL components and interfaces will help investigators collect data to achieve a 
thorough human factors investigation. 


a) Liveware — The Individual. The liveware component — the individual — is the centerpiece of the 
SHEL model. The data that should be collected to address this central component can be broken 
down into four categories: physical, physiological, psychological, and psychosocial. 

1) Physical factors deal with the physical limitations of the individual. Determine: 


— Was the individual physically capable of performing the required actions and movements? 


Physical limitations influence the ability to see, to act, to move, to reach, and to grab. Consider 
factors such as: 


Age Sex Weight 
Height Build Strength 
Coordination Sitting height Functional reach 


Leg length Shoulder width 
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Was the individual’s performance affected by visual, auditory, or other sensory limitations? 


Visual limitations might have: 


Caused illusions and disorientation. 

Limited the ability to perceive traffic. 

Influenced judgment of take-offs and landings. 

Impaired the reading of instruments or charts. 

Caused objects to be missed due to improper focus or empty field myopia. 


Some visual limitations are: 


Visual threshold Visual acuity 
Speed perception Depth perception 
Light adaptation Peripheral vision 
Glasses, contact lenses Empty field myopia 


Hearing or other sensory limitations are: 


Auditory threshold (hearing) 

Vestibular (acceleration and balance) 

G-tolerances 

Smell, touch 

Kinesthetic (detection of ‘movement through muscles’), might cause misunderstanding 
and illusions. 


Physiological factors deal with the individual as a complex organism encompassing a large array 
of systems. Determine: 


Was the individual physiologically fit to perform the required task? 
How did physiological fitness, or lack of, influence the person’s performance and judgment? 


How did the person’s ability to handle diseases, fatigue, or stress affect judgment and 
behaviours? 


Was the individual affected by any deprivation of any type of physiological need? 


Nutritional Factors 


Did nutritional factors affect the individual’s ability to: 


Respond to an action? 
Resist fatigue? 
Concentrate on the task? 


Did the individual lose weight recently? 
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— Was the person on a diet? Consider factors such as: 
Food intake in last 24 hours 
Hours since last meal 
Dehydration 
Health 
— Was the individual’s performance affected by any disease, pain, or dental condition? 
— Was the individual physically fit for the task? 
— Was the person pregnant? 
— Was the person obese? 


— Did the individual give blood recently? 


Stress 
— How did the individual's ability to handle stress affect his/her actions and behaviour? 
Emotional signs of long-term stress may include: 
Apathy or anxiety (restless, agitated) 
Irritability (oversensitive, defensive, arrogant) 
Overcompensation (denial, exaggeration, overworked) 
Behavioural signs may include: 
Withdrawal (social isolation, reluctance to accept responsibilities) 
Acting out (alcohol abuse, gambling) 
Physical (neglected appearance, tardy) 
Infractions (legal, at work, debts) 
Smoking 
Smoking might cause: 
Reduced dexterity 
Impaired vision 


Affect the judgment of time 
Irritability and frustration if deprived 
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Lifestyle 
— How does this person usually behave with others? 
— Was there a recent change in lifestyle, in activities, in friendships? What triggered it? 


— Could it be a way of coping with stress and pressures? What were those pressures? 


Fatigue 
Short-term (acute) fatigue could be influenced by: 


Amount of sleep (crew rest, nap duration) 
Food intake 

Nature of activities (activity level) 

Nature of tasks (skill fatigue) 

Stress level of the last 72 hours 

Duration of flight 


Long-term (chronic) fatigue might depend on: 


Work schedule, leave periods 
Circadian disrythmia (jet lag) 

Ability to cope with stress 

Sleeping patterns, deficit, disruption 
Nature of activities 

Family and work stressors 


Fatigue might have had an impact on: 


Short term memory (forgetting) 

Vigilance and concentration 

Ability to make decisions (limits the choices) 

Performance (lower standards, tendency to take shortcuts, taking undue risks) 
Stress coping 

Ability to perceive and visualize traffic 

Ability to hear communications 

Job motivation 


Alcohol/drugs 
Consider: 


Over-the-counter medication 
Prescriptions 

Illicit drugs 

Cigarettes, coffee, others 
Addiction, hangover, impairment 


Part Ill. Investigation 
Chapter 16. Investigating Human Factors IlI-16-27 





Alcohol and drugs might have: 


Caused drowsiness or dizziness 
Affected coordination and vision 
Reduced mental functions and sensory perceptions 


Incapacitation 
Partial incapacitation could be hard to detect. It could be caused by: 


Carbon monoxide or food poisoning 
Medical conditions 

Decompression, diving, trapped gases 
Nauseating and toxic fumes 

Motion sickness 


Partial incapacitation could have resulted in a wide range of symptoms such as: 


Hyperventilation, hypoxia, anoxia 

Dizziness, loss of consciousness 

Lack of concentration 

Fixation 

Decrease in mental functions or sensory perceptions 


Illusions 
Several types of illusions could be induced by the environment. 
Visual illusions: 


Black hole 

Flicker vertigo 
Autokinesis 

Circular or linear vection 
Geometric perspective 
Landing illusions 


Vestibular illusions: 
Somatogyral — the “leans”. 
Somatogravic — coriolis 
Elevator — “giant-hand” 
Document the environmental conditions at the time of the occurrence: 
Geographical peculiarities of that location 


Phase of flight and forces involved (FDR or ATC recordings) 
Instrument monitoring and actions 
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Psychological factors determine what individuals bring with them to work situations as a result of 
their knowledge and experience with the task and their mental capabilities. Included are training, 
experience, and planning; perceptions, information processing, attention span, and workload; 
personality, mental and emotional state, attitudes and mood. Determine: 


Information Processing 


— Did the information to be processed exceed human or the individual’s own limitations (mental 
capacity)? 


— How many “chunks” of information was the individual presented with (short-term memory 
capacity)? 


— Did it induce some biases, poor judgment or inappropriate decision making? 
— Did the nature of information processing cause an increase in workload? 
Possible signs include: 
Focus on a few alternatives 
Fixation, channelized attention 
Forgetting 
Lack of timing and coordination 


Perceptions 


— What was the individual's perception or mental model of the task to be performed? Was it 
accurate? 


— Did the individual suffer from any misperceptions, delayed perceptions or illusions caused by 
either the visual or vestibular system, or circumstances surrounding the flight? 


Consider different types of disorientation: 


Geographic 

Spatial 

Temporal 

Visual 

Situational awareness 


Consider the reaction time to: 
Detect something 


To make an appropriate decision, and 
To take an appropriate action 
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Attention 
— Did the level of attention required exceed the individual’s own limitations? 
Consider the following phenomena: 


Attention span 

Inattention (general, selective) 
Distraction (internal, external) 
Channelized attention 

Vigilance, boredom, monotony 

Habit pattern interference, substitution 
Time distortion 


Look for evidence of: 


Improper actions or improper reaction time 
A failure to notice or to react to an event 
An improper prioritization of tasks to be performed 


Workload 


Determine if the crew, by their own actions, decreased or increased the perceived level of 
workload. 


High workload has been known to cause: 


Disorganization, fixation, stress/panic 
Incorrect prioritization of tasks 

Task saturation 

Task shedding 

Improper decision making 

Loss of situational awareness 


Low workload could have caused: 
Boredom 
Inattention 
Complacency 
Lack of monitoring 


Attitude 


— What do the facts indicate about the individual’s attitudes toward work, the mission, others, 
and self? 
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Mood 
Motivation 
Habituation 
Attitude 
Boredom 
Complacency 
Overconfidence 


Consider expectations such as: 


Mind set 

Expectancy 

False hypothesis 

Desire to get home 
Determination to press on 
Risk-taking 


Mental/emotional state 


Fixation, gazing 
Tone of voice 


Precipitate or very slow reactions 


Experience/recency 


In the position 

In the aircraft 

For the mission 

On instruments 
With the procedures 


How did attitude influence motivation, quality of work, decision-making or judgment? 


Consider how the following might have affected the individual’s performance: 


Was the individual psychologically fit for the task? 
Did the individual’s mental and emotional state influence his or her approach to the situation? 


Consider factors such as apprehension, arousal level, self-induced mental pressure and 
stress as possible performance limiters. 


Look for signs of panic, stress, anxiety, including: 


Was the individual's experience, knowledge, and training sufficient, relevant, and applicable 
to the situation? 


Consider the individual’s overall or recent experience: 


In the environment (night, aerodrome, routes) 
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Inadequate overall or recent experience has been known to: 
Reduce the person’s confidence 
Raise the stress level 
Result in incomplete/inappropriate actions 
Increase the perceived workload level 


Knowledge 


Determine how much the individual knew about the aircraft, the systems, the procedures, or 
the environment. 


— _ Did the individual’s skill and airmanship have an impact on the occurrence? 
Lack of knowledge might: 

Reduce confidence 

Induce confusion 

Result in inappropriate and/or incomplete actions 
Training 
— Was there a relationship between the occurrence and the type of training received? 
— Were there any indications of negative or positive transfer? 


— Were weaknesses observed during training similar to the circumstances surrounding the 
occurrence? 


— Was the individual’s training sufficient, relevant, and applicable to the situation? 
— Consider different types of training: 

Initial ground and simulator 

Line 

Recurrent ground and simulator 


Planning 


Limited planning might have resulted in incomplete or inaccurate information which might 
have biased decision making and judgment. 


— Did the amount of planning (pre-flight or inflight) reflect the crew or management attitudes 
towards the flight? 
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4) Psychosocial factors deal with the pressures brought to bear on an individual by the social system 
(non-work environment). Included are events and stresses (e.g. a death in the family or financial 
problems) as well as relationships with others (friends, family, peers). Determine: 


— Did psychosocial factors motivate or influence the individual’s approach to a situation or the 
ability to handle stress or unforeseen events? 


To evaluate the pressure and stress levels experienced by the individual, compare the 
individual’s perception of the events against the perceptions of others. 


Consider: 


Mental pressure 
Interpersonal conflicts 
Personal loss 

Financial problems 
Significant lifestyle changes 
Family pressure 

Cultural differences 


b) Liveware-Liveware Interface. The liveware-liveware interface is the relationship between the individual 
and any other persons in the workplace. Staff management relationships also fall within the scope of 
this interface, as corporate climate and company operating pressures can significantly affect human 
performance. Data requirements span such subjects as human interactions, communication (verbal 
and non-verbal) and visual signals. Determine: 


Oral Communications 


— Did the interaction with other people or the communication in their work environment influence the 
performance of individuals, their attitudes, their level of stress, their perceived task demands and 
workload levels? 


Consider: 


Noise interference 
Misinterpretation 
Phraseology (operational) 
Content, rate of speech 
Language barrier 
Readback/hearback 


— Did verbal and non-verbal communication influence the sequence of actions in an inappropriate 
and irreversible manner? 
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Visual Signals 
— Did visual signals replace, support, or contradict the oral information? 


— Was the individual influenced by another’s non-verbal signs (body language)? Body language can 
direct an action, cause confusion, stress, misunderstanding, or create negative emotions and 
pressures. 


Crew Interactions 


Evaluate the crew’s interactions, compatibility in terms of personality, experience level and 
working habits. 


— _ Did the crew work together or against each other? 
— Did the crew make adequate use of their crew resources? 
Consider the following elements in evaluating the crew: 


Supervision 

Briefings 

Coordination 
Compatibility/pairing 
Resource management 
Task assignment 

Age, personality, experience 


Worker - Management 
Examine the different levels of management: The management level where decisions and plans 
are formulated, resources are allocated, and instructions are written, and the supervisory level 


where these actions are monitored and instructions followed. 


Determine if management policies regarding personnel issues affect human performance by 
causing: 


Inadequate levels of experience and knowledge 
Excessive workload or inadequate attention 
Resentment and unhealthy work environment 
Unsafe working conditions 

Labour relations 


— What was the union’s influence on workers, management, policies, and work habits? 


— Was there a recent company merger? Did it affect seniority, the individual’s work, contract 
negotiations, or policies? 
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Pressures 
Mental pressures due to operational policies can be real or perceived. 


— Was mental pressure imposed by fellow workers, by management, by the industry? To what 
degree was it felt? 


— What were the employee’s alternatives? 
— What was the morale of the enterprise? 


— Was there a high turnover rate? 


Supervision 


— Were there policies, standards, and quality controls in existence, available, current and 
adequate? 


— Were policies, standards, and quality controls adequately implemented, accepted, monitored, or 
supervised? 


— Was the ratio of supervisors to employees adequate? 


— Were supervisors performing other tasks? 


Regulatory requirements 
— Did management promote an operational environment which defied regulatory requirements? 


— What impact did the operational environment have on the employees’ decision making and choice 
of actions? 


— Were employees willing or forced to bend the rules? 
— Are the standards used and the existing regulations appropriate? 
Consider the different tasks of regulatory agencies: 
Implementation 
Audit 
Inspection 


Monitoring 
Surveillance 
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c) 


qd) 


Liveware-Hardware Interface. The liveware-hardware interface represents the relationship between 
the human and the machine. Data requirements span such subjects as cockpit and workstation 


configuration, display and control design, and seat design and configuration. Determine: 


Switches, controls, displays. 


— Were there any similarities, differences, and peculiarities in design or layout which might have 
affected the individual’s information processing characteristics. 


Determine the influence of: 


Determine the influence of instruments, displays, controls, switches, or alarms on: 


Design 

Location 
IIlumination 
Colours, markings 


Reaction time 

Habit patterns 
Workload 

Action sequencing 
Information processing 
Disorientation 
Confusion 


Evaluate how performance was affected by factors such as: 


Space 

Illumination 

Noise 

Climatic conditions 


Consider the following: 


Workspace layout, standardization 
Communication equipment 

Eye reference position, seat design 
Movement and visibility restrictions 
Information displays 

Alerting and warnings equipment 
Personal equipment interference (comfort) 
Data link 

Operation of instruments (finger trouble) 


Liveware-Software Interface. The liveware-software interface reflects the relationship between the 
individual and supporting systems found in the workplace. Data requirements span such subjects as 
regulations, manuals, checklists, publications, standard operating procedures, and computer software 


design. 
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Written information 
— Were manuals, checklists, maps, or any written documents accurate, readily available and used? 
Determine if the format, the content, or the vocabulary was: 
Consistent across similar documents. 
Easy to use and understand. 
Logical and appropriate. 
— Did written documents induce errors, increase response time, or generate confusion? 
Consider also: 
Publications 
Regulations 
Charts, NOTAMs 
SOPs 
Directives 
Signage 
Computers 
— Were computer displays or keyboards compatible with each other? 


— Did they induce confusion, increase reaction time, or hide blatant errors? 


— Did computers increase or decrease workload at the time of the occurrence? 


Automation 


— How did automation affect the individual’s actions and workload, work conditions, attitudes toward 
work and mental representation of the task? 


— How did automation influence the event sequence? 
— Did automation increase or decrease workload at critical times? 
— Did it induce complacency and boredom and result in missing important information? 
Consider: 
Task monitoring 
Task saturation 


Situational awareness 
Skill maintenance 
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Regulatory requirements 
— Was the individual qualified or certified for the task? 
Consider: 


Certification 

Qualification in position and on type 
Infraction history 

License/rating 

Medical certificate 

Internal 


e) Liveware-Environment Interface. The liveware-environment interface is the relationship between the 
individual and the internal and external environments. The internal environment is that of the 
immediate work area, including temperature, ambient light, noise, and air quality. The external 
environment includes both the physical environment outside the immediate work area as well as the 
broad political and economic constraints under which the aviation system operates. Data requirements 
include weather, terrain, and physical facilities, infrastructure and economic situation. 


— Were there any environmental factors which might have led the individual to take shortcuts, or 
make biased decisions or which might have created illusions by affecting vestibular, visual or 
auditory perceptions? 


— Were there any indications that the weather or dispatch, hangar, gate, or aerodrome infrastructure 
caused delays leading to shortcuts, reduced safety margins or limitations on the individual’s 
choice of actions? 


— Were there economic or regulatory pressures which biased decision-making? 
Consider maintenance facilities: 


Support equipment 

Availability of parts 

Operational standards, procedures, and practices 
Quality assurance practices 

Servicing and inspection 

Training 

Documentation requirements 


Appendix 1 to Chapter 16 


Failure Modes 


Skill-based performance 
Most of the errors at this level of performance can be grouped under two headings: 


a) inattention, which involves the failure to make a necessary attention check on progress; and, 


b) overattention, which involves the failure to make an attention check at an appropriate point in the 
action sequence. 


Inattention 
1. Capture error 


Definition: This error occurs when a sequence being performed is similar to a more familiar sequence, and the 
stronger plan of the familiar sequence captures control of the action. The outcome generally is a strong habit 
intrusion. 


Summary: The defining characteristic of a capture error is that a strong habit interferes with the performance of the 
intended action. 


2. Description error 


Definition: This slip may result when our internal description of the intended action is not sufficiently precise. A 
description error usually results in performing the correct action on the wrong object. The more the wrong and 
right objects have in common (especially approximate physical location), the more likely the error is to occur. 
Also, being distracted, bored, preoccupied, under stress, and not inclined to pay full attention to the task can 
lead to description errors. 


Summary: The defining characteristic of a description error is that ambiguity and/or distractions interfere with 


performance of the intended action. Usually the correct action is performed on the wrong object. 


3. Omission following interruption 
Definition: The required attention check is interrupted by some external event; the original action sequence 
continues but with parts of it omitted as a result of the interruption. Indeed, the interruption may even become 
part of the original sequence. 
Summary: The defining characteristics of an omission following interruption error are: 


a) an interruption disrupts an attention check; and 


b) an omission in the original action sequence results from the interruption. 
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4. Reduced intentionality 


Definition: \f there is a delay between the formulation of an intended action and the time it is carried out, and the 
appropriate attention checks are not made, the intended action will become overlaid by other demands. 


Summary: The defining characteristics of a reduced intentionality error are: 
a) there is a delay between planning and executing an action; 
b) the appropriate attention checks are not made; and 


c) actions stemming from other demands replace the intended action. 


5. Mode error 
Definition: A mode error can occur when a situation is falsely classified, and the resulting actions are inappropriate. 
The misclassification is termed a mode error when equipment is designed to have more actions than it has 
controls or displays, so the controls are required to do more than one action. When the equipment does not 
make the mode in which it is operating visible (for example, “on/off, the information provided to the operator is 
ambiguous and mode errors are likely. 
Summary: The defining characteristics of a mode error are: 
a) the equipment in use provides ambiguous information regarding control functions; and, 
b) the user is unsure of the mode status of the equipment and chooses inappropriate actions. 
Overattention 
1. Omission 
Definition: Attending to the progress of an action sequence at the wrong time can result in the assessment that the 
process is further along than it actually is and, as a consequence, some necessary step in the sequence can be 
omitted. 
Summary: The defining characteristics of an omission error are: 
a) there is an inappropriately-timed check of an action sequence; 


b) the assessment is that the action sequence is further along than it really is; and 


c) asegment of the action sequence is omitted. 


2. Repetition 


Definition: Attending to the progress of an action sequence at the wrong time can result in the assessment that the 
process is not at the point where in fact it actually is and an action already done is repeated. 
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Summary: The defining characteristics of a repetition error are: 
a) there is an inappropriately-timed check of an action sequence; and 
b) the assessment is that the action sequence is not as far along as it really is; and 


c) asegment of the action sequence is repeated. 


3. Reversals 
Definition: Mistimed checks can cause an action sequence to double back on itself. 
Summary: The defining characteristics of a reversal error are: 
a) there is an inappropriately-timed check of a bi-directional action sequence; and 


b) the action sequence is reversed. 


Rule-based performance 
Misapplication of good rules (rules of proven worth) 
There are several factors that conspire to bring about the use of the strong-but-wrong rules: 
1. Rule strength 
Definition: Strength of a rule depends on the number of times the rule has achieved a successful outcome. The 
more successful the rule, the stronger the rule becomes. In turn, the stronger the rule, the more likely it will be 
chosen, even when the match between the situation and the rule are less than perfect. 
Summary: The defining characteristic of a rule strength error is that an incorrect rule for the situation is chosen 
because it has often been used successfully in the past. 


2. General rules 


Definition: General rules are stronger than specific rules simply because they are encountered more frequently in 
the world. 


Summary: The defining characteristic of a general rule error is that an incorrect rule for the situation is chosen 
because of its greater frequency of occurrence. 


3. Information overload 


Definition: The amount of information confronting the decision-maker is so abundant that it exceeds the capacity of 
the cognitive system to capture and process all indications of the local situation. Without specific information 
about the true local situation, people may revert to other “Misapplication of good rules” errors, such as rule 
strength or a general rule, i.e. they would be inappropriate for this particular local situation. 
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Summary: The defining characteristic of an information overload error is that an incorrect rule for the situation is 
chosen because of an overwhelming amount of information confronting the decision-maker. 
4. First exceptions 


Definition: The first time a person encounters a significant exception to a general rule, that general rule, particularly 
if it has been very reliable in the past, will continue to “rule” or govern. 


Summary: The defining characteristic of a first exceptions error is that an incorrect general rule for the situation is 
chosen because the decision-maker finds it difficult to make the first-time choice of the correct alternative. 
5. Rigidity 
Definition: \f a rule has been successfully used in the past, there is an overwhelming tendency (almost stubbornness) 
to use it again even when the circumstances no longer warrant its use. So strong are such rules, that we will 
apply familiar but cumbersome solutions even when simpler and more elegant solutions are readily available. 
Summary: The defining characteristic of a rigidity error is that an incorrect rule is chosen because the decision- 
maker strongly believes in its “correctness”, despite the presence of more appropriate options. 
Application of bad rules 
1. Wrong rules 
Definition: The “wrongness’” in this type of error stems from a defect or weakness in the strategy of the rule itself. 
Summary: The defining characteristic of a wrong rule error is that a rule choice is deemed incorrect because the 
plan or structure of the rule is flawed. 
2. Inelegant or clumsy rules 
Definition: Without the benefit of expert instruction or because one is operating in a forgiving environment, we may 
employ solutions that are clumsy, circuitous or even bizarre, but they work and may even become established 
as part of our rule-based procedures. 
Summary: The defining characteristic of an inelegant or clumsy rule is that an inefficient rule is permitted to flourish 
because checks within the operating environment do not exist or have not functioned properly. 
3. Inadvisable rules 
Definition: Although this type of rule may be perfectly adequate to achieve its immediate goal most of the time, 
continuing to use it in the long run is inadvisable because it can lead to avoidable accidents. Typically, this type 


of rule violates established codes or operating procedures and, in the long run, such activity can result in an 
accident. 
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Summary: The defining characteristics of an inadvisable rule are: 
a) although the rule works, there is high accident risk associated with its use; and 


b) the rule breaches established procedures, standards, etc. 


Knowledge-based performance 


In problem-solving, we often resort to the use of heuristics or mental rules of thumb that help us to diagnose the problem 
without expending too much mental effort and thus too much time. Often, these heuristics serve us well; however, they 
are shortcuts and as such we may be shortchanging ourselves of adequate and accurate information; that is, rather than 
processing all available information and following reasoning to its most probable and logical end, we take a shortcut 
which may give us a false understanding of the actual situation. 


1. Salience bias 


Definition: This is the tendency to focus on physically important characteristics or evidence (e.g. loud, bright, recent, 
centrally visible, easy to interpret) and ignore critical cues that might provide diagnostic information about the 
nature of a problem. Salience bias results from that fact that decision-makers do not necessarily process all 
information available to them, particularly under times of stress. This bias is also known as “selectivity” due to 
the selective processing of information that is engaged by a decision-maker. 


Summary: The defining characteristic of a salience bias error is that attention is either given to the wrong 
characteristics or not given to the right characteristics. 


2. Confirmation bias 


Definition: This is the tendency to seek information that will confirm what we already believe to be true. Information 
that is inconsistent with the chosen hypothesis is then ignored or discounted. 


Summary: The defining characteristic of a confirmation bias error is that attention is only given to information that 
supports a previously chosen hypothesis. 


3. Representative heuristic 


Definition: This is the tendency to match cues drawn from a current situation to those that form a mental 
representation of a particular situation that already exits in long-term memory. Simply stated, a comparison is 
made between perceived information and what exists in memory. 


If it is decided that the cues of the current situation match those of a particular situation stored in memory, then 
the conclusion drawn is that the situations are similar or the same. In turn, it follows that the decision-maker 
may conclude the actions taken previously are appropriate again. 


However if the cues perceived from the current situation were not complete or were ambiguous, an incorrect 
match could occur. Should the pattern of cues in long-term memory not be a good indicator of the current 
situation, then the person’s judgment and decision-making could be faulty. Once a match has been established, 
people tend to cling to that interpretation, often not changing it despite evidence to the contrary. 
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Summary: The defining characteristics of a representative heuristic error include: 
a) perceived information is incorrectly matched with specific patterns stored in memory; and 
b) current actions taken are incorrect because they are based on the wrong interpretations of the current 
situation. 
4. Availability heuristic 
Definition: This is the tendency to diagnose a situation using the hypothesis most available in memory, i.e. giving 
undue weight to facts that come readily to mind. The most available hypothesis may not be the most probable, 
but simply the most recently experienced or less complicated one. 
Summary: The defining characteristic of an availability heuristic error is that an inappropriate hypothesis is selected 
because of its convenience. 
5. “As if’ heuristic 


Definition: This is the tendency to treat all information sources as if they were of equal reliability. Information that is 
at best marginal is given the same degree of reliability as that which is very reliable. 


Summary: The defining characteristic of an “As if’ heuristic error is that all perceived information is incorrectly given 
the same weighting of reliability. 
6. Framing 
Definition: \n risky decision-making, there is a tendency to frame the problem as a choice between gains or between 
losses. With respect to losses, people are biased to choose the risky loss which is less probable although more 
disastrous, rather than the certain loss. 
Summary: The defining characteristics of a framing error are: 
a) alternatives are rated in terms of losses (or gains); and 
b) given the choice between a sure loss versus an uncertain probability of disaster, people are biased toward 
the risky choice. 
7. Overconfidence 
Definition: There is a tendency for people to overestimate the correctness of their knowledge of the situation and its 
outcome. The result is that attention is placed only on information that supports their choice and ignores 


contradictory evidence. 


Summary: The defining characteristic of an overconfidence error is that attention is given to certain information 
because an individual overrates their knowledge of the situation. 
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An Integrated Process for 
Investigating Human Factors 


The work systems/organization and human error/behaviour frameworks, described in Chapter 16 provide investigators 
with a focus on the potential unsafe conditions that an investigation of human factors strives to uncover. The following is 
a process that integrates those frameworks into a step-by-step systematic approach for use in the investigation of 
human factors. 


The process can be applied to both types of occurrences; i.e. accidents and incidents. Illustrated in Figure III-16-9, the 
process consists of seven steps, Steps 4 to 7 being for each unsafe act/decision: 


= 


) collect occurrence data; 

2) determine occurrence sequence; 

3) identify unsafe acts/decisions and unsafe conditions’; 

4) identify the error type or adaptation; 

5) identify the failure mode; 

6) identify behavioural antecedents; and 

7) identify potential safety problems. 
Steps 3 to 6 are useful to the investigation because they facilitate the identification of latent unsafe conditions. Step 7, 
the identification of potential safety problems, is based extensively on what factors were identified as behavioural 
antecedents. 
The seven steps of the process correspond to several of the tasks that are completed under the larger functional 
activities of investigators during an investigation (Figure III-16-10 illustrates a breakdown of these tasks by investigative 
function). The following is a brief discussion of each of the above steps. 
Step 1 — Collect occurrence data 
The first step in the human factors investigation process is the collection of work-related information regarding the 
personnel, tasks, equipment, and environmental conditions involved in the occurrence. A systematic approach to this 


step is crucial to ensure that a comprehensive analysis is possible and that the logistical requirements of collecting, 
organizing and maintaining a relevant occurrence-related database are met. 





2. At times, an unsafe condition may be a result of a natural occurrence. At other times, an unsafe act or decision may result from an 
unsafe condition which itself was established by a fallible decision. In the former case, the investigator may ‘jump’ from Step 3 to 
Step 7; in the latter case, the investigator should proceed through Steps 3 to 7. 
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Figure Ill-16-9. An integrated process for occurrence investigation 
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Figure Ill-16-10. Investigation functions and component task activities 


To conduct an effective systematic data collection, the investigator must recognize from the outset that transportation 
workplaces, such as aircraft or air traffic control centers are parts of larger “work systems”, with each system consisting 
of varied and interrelated elements as mentioned earlier, i.e. human, task, equipment, and environment elements. 


For complex systems, where there are numerous interactions between the component elements, there is constant 
danger that critical information will be overlooked or lost during an investigation. Use of the SHEL model as an 
organizational tool for the investigator's workplace data collections helps avoid problems downstream because: 


a) it takes into consideration all the important work system elements; 
b) it promotes the consideration of the interrelationships between the work system elements; and 


c) it focuses on the factors that influence human performance by relating all peripheral elements to the 
central liveware element. 


Figure Ill-16-11 is an adapted illustration of how this model can be applied to a complex system where multiple liveware, 
hardware, software and environmental elements exist. 


At this step, the process initially attempts to answer the more simplistic questions concerning “what, who, and when” and 
then moves to more complicated questions of “how and why”. The resulting data becomes, for the most part, a collection 
of events and circumstances comprised of acts and conditions. Some of these will be of interest as unsafe acts and 
unsafe conditions. 
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Figure Ill-16-11. Modified SHEL model 
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Step 2 — Determine occurrence sequence 


As the investigator moves to addressing questions of “how and why”, there is a need to link the data identified in the first 
step of the process. Reason’s (1990) model of accident causation, utilizing a production framework, can be used by an 
investigator as a guide to developing an occurrence sequence. As well, Reason’s model facilitates further organization 
of the work system data collected using the SHEL model, and an improved understanding of their influence on human 
performance. The occurrence sequence is developed by arranging the information regarding occurrence events and 
circumstances around one of five production elements, i.e. decision makers, line management, preconditions, productive 
activities, and defenses. 


These production elements themselves are basically aligned in a temporal context. This temporal aspect is an important 
organizing factor since the events and circumstances that can lead to an accident or incident are not necessarily 
proximate in time, nor in location, to the site of the occurrence. By establishing a sequential ordering of the data, 
Reason’s (1990) concept of active versus latent factors is introduced. 


Active factors are the final events or circumstances which led to an occurrence. Their effect is often immediate because 
they occur either directly in the system’s defences (e.g. disabled warning system) or at the site of the productive 
activities (i.e., the integrated activities of the work system’s liveware, software and hardware elements), which would 
indirectly result in the breaching of the system’s defences (e.g. use of the wrong procedure). 


Underlying or latent unsafe conditions may reside at both the personal and the organizational levels (LUC factors); they 
may be present in the conditions that exist within a given work system (referring to the preconditions element in the 
model). Examples of latent unsafe conditions include inadequate regulations, inadequate procedures, insufficient 
training, high workload and undue time pressure. 


In practice, Steps 1 and 2 may not be mutually exclusive. As the investigator begins the data collection step, it would be 
only natural that an attempt be made to place the information, albeit often fragmentary in the preliminary stages of an 
investigation, into the context of an occurrence sequence. To facilitate this concurrent activity, the SHEL and Reason 
models can be combined as illustrated in Figure Ill-16-12. 


Steps 3-5 — An overview 


Steps 3 to 5 are based upon the behaviour and error framework discussed above. The framework provides “pathways” 
that lead from the identification of the unsafe act/decision (Step 3) to the identification of wnat was erroneous about the 
action or decision (Step 4) and finally to its placement within a behaviourial context (i.e. a failure mode within a given 
level of performance in Step 5. The behaviour and error framework as illustrated in Figure II|-16-13 is particularly useful 
in exploring hypothetical reconstructions of the occurrence facts. 


Step 3 — Unsafe acts/decisions and conditions 


In Step 3 of the process, the investigation and/or analysis takes on a reductionist nature where the information gathered 
and organized using the SHEL, Reason, and LUG frameworks is used to initiate identification of occurrence causal 
factors, i.e. unsafe acts/decisions and conditions. There may be several acts, decisions and/or conditions which are 
potential unsafe candidates, thus necessitating iterative assessments of the occurrence facts. The SHEL and Reason 
hybrid model (refer to Figure III-16-12) can provide a useful base for conducting such iterative assessments. 
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Figure Ill-16-12. SHEL and Reason hybrid model 
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The data collected during an investigation (i.e. events and circumstances) can be organized, using multiple components 
of the modified SHEL model, into a framework surrounding an occurrence template (in this case the accident scenario), 
based upon the Reason model. In this way, each occurrence can be described by unique framework of events and 
circumstances, the investigator being interested in identifying those which constitute the occurrence’s causal factors, i.e. 
the unsafe acts/decisions and conditions. 


When an unsafe act, decision or condition is identified, the focus shifts to determining the genesis of that particular act. 
Further investigation and/or analysis may reveal other unsafe acts/decisions or conditions antecedent to the causal 
factor that was initially identified. 


As noted earlier, several unsafe acts and decisions may be identified throughout Steps 1 and 2 of the process. The last 
unsafe act precipitating the occurrence often provides a convenient starting point for reconstruction of the occurrence. 
This last act or decision differs from the others in that it can be viewed as the definitive action or decision which led to 
the occurrence, i.e. the last act or decision that made the accident or incident inevitable. Although it is usually an active 
failure, the last unsafe act or decision can be embedded in a latent unsafe condition, such as a flawed design decision 
which led to a system failure. 
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Figure Ill-16-13. The GEMS Framework (adapted from Reason, 1990) 
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Step 4 — Identify error or violation type 


This portion of the process, i.e. Step 4, is initiated for each unsafe act/decision by posing the simple question, “What is 
erroneous or wrong about the action or decision that eventually made it unsafe?” The identification of the type of error or 
violation involves two substeps (see Figure IIl-16-13). 


1) Unintentional or intentional action. First, it is necessary to determine whether the error or adaptation 
was an unintentional or intentional action. “Did the person intend the action?” If the answer to that 
question is no, then it is an unintentional action. However, if the answer to the question “Did the 
person intend the action?” is yes, then the action is intentional. 


2) Error type or violation. The second substep is the selection of the error type or violation that best 
describes the failure, keeping in mind the decision regarding intentionality. There are four potential 
error/adaptation categories, i.e. slip, lapse, mistake and violation. 


— A\sslip is an unintentional action where the execution failure involves attention. 
— A\lapse is an unintentional action where there is a memory failure. 
— A mistake is an intentional action, but there is no deliberate decision to act against a rule or plan. 


— A\violation is a planning failure where a deliberate decision to act against a rule or plan has been 
made. 


Step 5 — Identify failure modes 


The designation of separate activities implied by Steps 4 and 5 may be somewhat arbitrary in terms of what actually 
occurs when an investigator attempts to reveal the relationship between the occurrence errors/violations and the 
behaviours that lead to them. In simplest terms, a behaviour consists of a decision and an action or movement. In Step 3, 
the action or decision (i.e. unsafe act or decision) was identified. In Step 4, what was erroneous regarding that action or 
decision was revealed. In Step 5, the focus is now placed on the decision that eventually led to the erroneous action or 
decision identified in Step 3. This is accomplished by placing the errors (slips, lapses and mistakes) and violations into 
the context of performance (behaviour), i.e. how was one performing at the time of the failure? 


The GEMS framework facilitates the linkage of an error/violation to an individual’s level of performance at the time the 
failure occurred. By following through to the next step (refer to Figure III-16-14), one can begin to understand how errors 
and violations can have their roots in common behavioural failure patterns (i.e. failure modes) and are not necessarily 
the result of irrational behaviour. 


Recalling from 16.2.16 to 16.2.20, the error types and violations are matched against three categories of behaviour. The 
following is a brief description and matching of the error types and violations with each of the three performance levels: 


1) slips and lapses occur during skill-based performance where actions tend to be based on stored 
routines and there is little, if any, conscious decision-making; 


2) mistakes are involved in rule-based performance where decisions are based on learned procedures; 
and 


3) mistakes and violations occur during knowledge-based performance where decisions are based on 
knowledge and experiences (no set procedures) which necessitates evaluations. 
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Figure Ill-16-14. Breakdown of behaviour into failure modes 


Ill-16-54 Manual of Aircraft Accident and Incident Investigation 





Within each level of performance (i.e. behavioural category), there are different ways or modes a failure can occur (refer 
to Figure IIl-16-14 for general descriptions of these failure modes). The errors and violations identified in Step 4 can be 
related to the failure modes as demonstrated by following a given pathway from Figure II|-16-13 to Figure III-16-14. A list 
of specific failure modes (or behavioural groupings) was derived from a number of reference sources (Norman, 1981; 
Norman, 1988; Weiner and Nagel, 1988; Reason, 1990) and a description of each can be found in Appendix 1 to 
Chapter 16. 


Step 6 — Identify behavioural antecedents 


In Step 5, the focus was placed on the identification of failure modes which described erroneous decision-making or 
unsafe acts. In order to uncover the underlying causes behind the decision of an individual or group, it is important to 
determine if there were any factors in the work system that may have facilitated the expression of the given failure mode 
(and hence the error/violation and the unsafe act). These factors have been termed behavioural antecedents. 


The three performance or behaviour levels can be broken down into common behavioural failure patterns or modes of 
failure. Descriptions of these failure modes are provided in Appendix 1 to Chapter 16. 


These behavioural antecedents can be found by examining the work system information collected and organized using 
the SHEL, Reason, or LUC frameworks in Steps 1 and 2. The re-examination of these data again emphasizes the 
iterative nature of this investigative process where it may even be deemed necessary to conduct further investigations 
into the occurrence. 


Step 7 — identify potential safety problems 
The identification of potential safety problems is based extensively on what factors were identified as behavioural 
antecedents. Once again this underscores the importance of the application of a systematic approach to Steps 1 and 2 


of the process which sets the foundation for the subsequent analysis steps. Where appropriate, the potential safety 
problems can be further analyzed to identify safety deficiencies and recommendations for safety actions. 


Appendix 3 to Chapter 16 
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Chapter 17 


SURVIVAL, EVACUATION, SEARCH, 
RESCUE AND FIRE FIGHTING 


17.1 INTRODUCTION 


17.1.1 In general, the Survival Factors Group is responsible for developing and documenting information 
regarding the following areas of interest to the investigation: 


9) 


impact and occupant dynamics; 
evacuation and survival; 

search and rescue; 

survivor wellbeing post evacuation; 
aircraft interior configuration; 

crew training records; and 


crash injury and survivability aspects. 


It is also important for the Survival Factors Group to work closely with other Groups involved in the investigation as many 
of the areas of responsibility will overlap. 


17.1.2 Much progress has been made over the past decades to decrease the accident rate worldwide. Aircraft 
manufacturers, airlines, professional associations, regulators and investigators have all worked toward a zero accident 
rate. The industry has also seen improvements in the area of occupant survival covering such topics as: 


16 g seats; 

seat blocking (fire protection); 

toxicity levels in cabin materials; 

cabin crew training; 

in-flight fire fighting procedures; 

Crew Resource Management (CRM); and 


floor level lighting. 
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These improvements in aircraft cabin safety have come about as a result of the dedicated work of the accident 
investigators and their industry counterparts. 


17.1.3 Occupant survival following an accident/incident is an important issue for the investigation team. The 
information collected as a result of a comprehensive Survival Factors investigation can be used in the areas of education, 
research, safety promotion and accident/injury prevention and can do much to enhance flight safety worldwide. 

17.1.4 This can only be achieved when the correct expertise is provided to the group, including someone from the 
cabin safety area. Occupant survival information has been missing from many accident/incident reports where 
survivability was an issue. For this reason safety improvements may have been overlooked. 

17.1.5 Many investigative bodies have solved this problem by creating an investigator position with specific 
expertise in the area of cabin safety. While this is the ideal solution, it may not always be possible. In this case, someone 
from the appropriate airline department and/or professional association should be seconded to the Survival Factors 
Group. Following the investigation, the information gathered must be analyzed and, if applicable, sent to the appropriate 


regulators, manufacturers and industry experts in a safety recommendation. This will lead to improvements to equipment, 
procedures and training. 


17.2. INVESTIGATION DETAILS 

17.2.1 The information collected during an investigation depends on its size and scope. In some accidents the 
survival aspects play a major role and in those investigations considerable amounts of information will be collected. They 
may be broken down into the following categories: 

a) general flight information; 

b) aircraft configuration; 

c) cockpit crew information; 

d) cabin crew information; 

e) passenger information; 

f) aircraft damage and description of the crash site; 

g) medical and pathological findings; 

h) crash fire rescue response; 


i) survival aspects; and 


j) interviews. 
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General flight information 
17.2.2 The following information should be documented as soon as it is available: 
a) name of the operator; 
b) location, date and time of the occurrence; 
c) weather conditions, aircraft altitude and manoeuvres; 
d) list of cockpit crew members; 
e) list of cabin crew members; 
f) passenger manifest including names, seat assignments and lap-held infants; and 


g) transcripts or summary of CVR and ATC recording, DFDR, and radar track during the occurrence. 


Aircraft configuration 
17.2.3 Prior to starting the field investigation it may be helpful to: 
a) establish the aircraft type and registration; 
b) obtain engineering drawings of the cockpit; 


c) obtain engineering drawings of the cabin that depict cabin/seat layout, seat pitch, galleys, lavatories, 
location of bulkheads and emergency exits; 


d) obtain copies of the aircraft log books including the cabin log; 
e) company SOPs, checklists and training procedures for this type of emergency; and 


f) consider the aircraft phase of flight and estimated or actual configuration and flight manoeuvres. 


Cockpit crew information 
17.2.4 a) Names and titles. 


b) Record of emergency training. 


Cabin crew information 
17.2.5 a) Names and titles. 


b) Record of emergency training. 
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Passenger information 


17.2.6 List the number of passengers on board in the following categories: 
a) male; 
b) female; 


c) children (25 months to 16 years); 
d) infants (up to 24 months); and 


e) physically or mentally challenged. 


Aircraft damage and description of the crash site 


17.2.7 Thorough documenting of the aircraft and surrounding site is essential in order to establish how and why 
injuries and fatalities occurred. Much of the information obtained during this on-site phase of the investigation will be 
used to generate recommendations for future improvements in the design and operation of safety equipment and aircraft 
interiors. If a safety recommendation is issued in the area of survivability, much of this information should be sent to the 
aircraft and equipment manufacturers for further study and change where appropriate. 


17.2.8 In the case of damage as the result of unlawful interference, and explosive decompression as the result of 
bombs or weapon discharge, a criminal investigation may be conducted in addition to a safety investigation. 


17.2.9 An overall site survey should be conducted prior to focusing on any specific area of the crash site. 


a) Cockpit. Compile a description of the cockpit arrangement using engineering drawings from the 
operator and manufacturer, photos and sketches with specific attention to the following: 


1) condition of the instrument panel, pedestal and overhead panel including evidence of impact, 
thermal damage and the direction and extent of any deformation; 


2) condition of the yoke and rudder pedals including any fractures, impact evidence and the direction 
and extent of any deformation; 


3) condition of the windshields, windows and escape hatches including evidence of impact, thermal 
damage and the direction and extent of any deformation. The condition of the escape hatch 
locking mechanism and the escape rope/slide device should be included; 


4) condition of the crew life support systems/equipment, i.e. smoke masks, goggles, oxygen masks; 
5) condition of the crew seats including evidence of impact, thermal damage, direction and extent of 
deformation, integrity of the tie downs and rails and the direction in which the seat and tie down 


components failed; 


6) record the seat manufacturer, date of manufacture, model numbers, applicable TSO and rated 
load; 
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7) condition of the crew seatbelts, shoulder harnesses, release mechanisms and inertia reels; 

8) record the manufacturer of the restraint devices, date of manufacture, model numbers, applicable 
TSO and rated loads; 

9) record the position of the crew seats from the adjustment pins, seat tracks, etc.; 

10) obtain cockpit visibility photos as required; 

11) condition of the cockpit door including evidence of thermal damage, jamming, direction of 
opening, condition of locks, condition of escape panels and extent of deformation; 

12) condition of cockpit safety equipment, i.e. first aid kit, fire extinguisher usage and mounting, crash 
axe usage and mounting; 

13) position and condition of personal luggage, flight bags and documents; and 

14) perform necessary tests on equipment which has failed, to ensure design criteria was met during 


c) 


the accident sequence. 


Passenger cabin. Compile a description of the aircraft cabins using engineering drawings from the 
operator and manufacturer, photos and sketches with specific attention to the following: 


1) 


3) 


in the case of explosive decompression and/or emergency descent, what were the areas of failure 
and the results of such failure? Determine whether emergency oxygen was used and, if yes, 
whether there were any difficulties; 


condition of the overall cabins including deformation, thermal damage, failed ceiling panels, failed 
overhead bins, failed seats, failed bulkheads, failed flooring, etc. It is important to remember that 
the location of the cabin furnishings may be as a result of the crash fire rescue activities and not 
the impact forces; and 


some aircraft have cabin video monitoring and recording for security considerations. When such 
equipment is installed, the video recording would be essential in the investigation. 


Exits. Document the following: 


location and condition of all exits. Were they open or closed? 
location of all exit windows/hatches; 

deployment of ropes, tapes or inertia reels; 

damage to exits and surrounding fuselage; 

position of the arm/disarm lever; 

position of the girt bar; 

position of the exit-opening handle; 


condition of the power assist device (record pressure if appropriate); 
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9) 


10) exit sill height above the terrain if applicable. 


assist space available at exit; and 


Evacuation devices. Document the following: 


1) 


2) 


3) 


the position of the device, i.e. deployed, stowed, inflated, deflated, removed from the aircraft; 


name of manufacturer, date of manufacture, model number, serial number, applicable TSO and 


date of last overhaul; and 


any damage to the slide or slide raft. 


Emergency equipment. Using the Cabin Attendant Manual as a guide, document the location and 
condition of the emergency equipment in the cabin. The manufacturer, model number, serial number, 
applicable TSO, date of last overhaul and/or expiry date as applicable should be recorded for each 
piece of emergency equipment. A functional test should be performed on each piece of emergency 
equipment if possible. Document the following: 


1) 


2) 


10) lavatory waste bin automatic extinguishers; 


flashlights; 

megaphones; 

fire extinguishers; 

protective breathing equipment (PBE); 
crash axe; 

pry bar; 

fire fighting protective gloves/suits; 
smoke barriers; 


smoke detectors; 


11) first aid kits; 


12) medical kits; 


13) defibrillator; 
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14) emergency locator transmitter (ELT); 


15) oxygen bottles; and 


16) emergency lights (interior and exterior, cockpit and cabin). 


The condition of the brackets and/or restraint systems for all of the above should also be documented. 


If the accident involves water contact, the condition and location of the following should be added to 
the above information: 


life rafts or slide rafts; 
individual flotation devices (vests or cushions); 
survival kits; and 


water conditions at the time of impact, i.e. wave height, swell height and water temperature. 


Cabin crew and passenger seats. Document the following: 


1) 


4) 


condition of the crew and passenger seats including evidence of impact, thermal damage, 
direction and extent of deformation, integrity of the tie-downs and rails and the direction in which 
the seat and tie-down components failed; 


record the seat manufacturer, date of manufacture, model numbers, serial number, applicable 
TSO and rated load; 


condition of the crew and passenger restraint systems, i.e. seatbelts, shoulder harnesses, release 
mechanisms and inertia reels; and 


record the manufacturer of the restraint devices, date of manufacture, model numbers, serial 
number, applicable TSO and rated loads. 


Stowage compartments. Document the following: 


1) 


condition of the overhead bins including placarded weight restrictions; 

condition of the latching mechanism; 

weight and size of the contents if available; 

condition of all closets and compartments including placarded weight restrictions; 
condition of restraint devices; and 


weight and size of contents if available. 
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Cabin baggage. Document the following: 


1) condition and location of all carry-on luggage found in the cabin, i.e. overhead bins, under-seat 
storage, closets, piled near exits; 


2) condition and location of any seat-loaded baggage found in the cabin; 
3) condition of any restraint device used; 


4) record the manufacturer of the restraint device, date of manufacture, model number, serial 
number, applicable TSO and rated loads; and 


5) condition and location of any additional personal effects found in the cabin including cabin crew 
luggage. 


Cargo. 


1) Was the cabin configured for combination passenger/cargo operation? If yes, determine whether 
this affected the incident/accident; and 


2) was the stowed cargo or baggage involved in the incident/accident? If yes, were compartment 
sensors activated and/or fire suppression systems activated? 


Communication systems. The manufacturer, model number, serial number, applicable TSO, date of 
last overhaul and/or expiry date as applicable should be recorded for each communication system. A 
functional test should be performed on each communication system if possible. Describe the following: 
1) condition of the PA system; 

2) condition of the interphone system; and 

3) condition of the emergency evacuation alarm including the position of the switches. 


Safety briefings. Document the following: 


1) content and method of delivery of the pre-flight safety briefing, i.e. cabin crew to cabin crew, 
cockpit crew to cabin crew, cabin crew to passengers; 


2) content and method of delivery for the exit row briefing; 
3) content of the safety briefing cards, i.e. were they on the aircraft, did they match the aircraft, were 
they easily accessible, were they easy to understand, was there one (1) for each passenger seat; 


and 


4) content of the passenger safety video. 
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n) Galleys. Document the following: 
1) condition and location of all galley carts, stowage units, stowage cavities, and latching devices; 
2) condition and location of all galley curtains, curtain rods and stowage mechanisms; 
3) condition and location of any loose service items found in the cabin; 


4) record the galley manufacturer and model number as applicable for each piece of galley 
equipment; 


5) obtain a copy of the airline’s galley stowage charts in order to determine weight restrictions; and 
6) maintenance history, record of faults/failures. 
17.2.10 Information gathered during the on-site phase of the investigation should be made available to the 


members of the Survival Factors Group conducting the cabin crew and passenger interviews in order to obtain any 
additional information or clarification. 


17.3. MEDICAL AND PATHOLOGICAL FINDINGS 
The Survival Factors Group should work closely with the group responsible for the medical and pathological aspects of 
the investigation to determine the cause of injury/death of the crew and passengers. Injury patterns of cockpit and cabin 


crew may point toward equipment failures and focus additional investigation. See Chapter 18 for Pathology investigation 
details. 


17.4 RESPONDING AGENCIES 
17.4.1 This section of the investigation would normally be the responsibility of the Survival Factors Group. Other 
groups should be consulted as necessary as many of the issues dealing with occupant survival are associated with 
topics of other groups such as the Structures Group. 
Search and rescue response 

17.4.2 Document the search and rescue efforts, particularly if the accident occurred in a remote area. 

a) Document any problems encountered during the rescue. 

b) Document the method, time and by whom the rescue personnel were notified. 

c) Document number of personnel involved and conduct interviews as required. 

d) Document type and number of rescue units involved. 

e) Document pertinent response times. 


f) Document where the occupants were rescued from and where they were taken. 
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17.4.3 


17.4.4 


Document how many occupants were rescued alive and how many victims were removed. 
Document the time necessary to complete the rescue operations. 
Obtain reports from all participating rescue organizations. 


Determine the date of the last airport accident drill involving rescue personnel and obtain a copy of the 
report. 


Note.—A secondary benefit from such documentation is that it can be used to fulfill certain training 
requirements of emergency responders. 


h) 


Police response 
Document the involvement of the local police department. 
Obtain any photographs taken at the accident site. 
Document the number of responding units, response times and the number of personnel involved. 
Describe the security perimeter and any related problems. 
Document any traffic control problems. 


Determine the date of the last airport drill involving fire fighting personnel and obtain a copy of the 
report. 


Interview the responding officers as required. 


Obtain any police accident/incident reports. 


Medical response 
Document the method, time and by whom the local hospitals were notified. 
Determine if medical personnel responded to the site and if so, at what time. 
Determine if a triage unit was set up at the site. 
Document the services provided by the local hospitals. 
Document any problems experienced by the responding medical personnel. 
Interview medical personnel as required. 


Obtain copies of the hospitals’ disaster plans. 
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h) Determine the date of the last airport disaster drill involving the hospitals and obtain a copy of the 
report. 


i) | Obtain any accident reports from the hospitals. 
j) | Outline the distribution and disposition of the injured. 


k) Determine if any Critical Incident Stress Debriefing was offered to the crew and passengers. 


Community/airport disaster response 


17.4.5 a) Describe the community/airport response plans or lack thereof which enabled them to respond to the 
accident. 


b) Determine the date of the last disaster drills. 
c) Obtain a copy of the reports. 
d) Document any problems encountered during the response to the accident. 


e) Obtain copies of all pertinent disaster plans, response reports and critiques by any local disaster 
planning offices. 


f) Interview response personnel as required. 
g) Describe the command post, equipment and communications and document any problems 
encountered. 
Fire response 


17.4.6 a) Document the efforts of the on and/or off airport fire fighting operation from the time of notification to 
the departure of the equipment from the crash site. 


b) Document any problems encountered during the fire fighting activities. 

c) Document the method, time and by whom the fire departments were notified. 
d) Document the name of the on-scene commander. 

e) Describe the field command post if applicable. 

f) Describe the method of communication used by the fire fighters. 

g) Document any difficulties getting to the site. 

h) Describe the conditions when the fire fighters arrived at the site. 


i) Obtain or sketch out a map of the site including access routes, runways, location of vehicles, wind 
direction, etc. 
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j) | Describe the origin and propagation of the fire. 
k) Document the quantity and type of fuel on board. 
1) Document the number of personnel involved and conduct interviews as required. 
m) Determine the number, size, type and discharge rate of the hand lines deployed. 
n) Document any difficulties encountered by the fire fighters in attempting to gain entry to the aircraft. 
0) Determine whether the fire fighters were familiar with the aircraft. 
p) Determine whether the fire fighters were familiar with the evacuation duties of the cabin/cockpit crew. 
q) Document the time from the first truck arriving at the site to the time the fire fighting was complete. 
r) Determine the date of the last airport drill involving fire fighting personnel and obtain a copy of the 

report. 
s) Obtain reports from all participating fire fighting organizations. 
t) Document the number and type of response vehicles including a description of the personnel on 
board, travel time and distance to the site, agent capacity, discharge rate and quantities used. 
u) Document any equipment deficiencies and lack of resources. 
Survivor well-being post evacuation 

17.4.7 a) Document any problems encountered after the evacuation. 
b) Determine the methods used to get the passengers and crew into a safe structure. 
c) Determine who is responsible for this task. 
d) What first aid services existed in the passenger reception area? 
e) Whois responsible for passenger security after the occurrence? 
f) Which agency is responsible for the overall operation? 
g) Is there a Family Assistance Plan in place at the airline and/or airport? 
h) What training is provided for the ground-handling agents in a code share situation? 


Are the non-emergency personnel trained to respond to an occurrence? 


Are religious personnel available to the survivors and families? 
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Is there a location set aside away from the media for family and survivors to reunite? 


Are there media controls in place? 


m) Howis the return of passengers’ belongings handled? 
n) Whois responsible for setting up a “morgue” type facility? 
0) Whois responsible for notification of next of kin and was this done properly? 
p) Whois responsible for implementing airspace restrictions over the crash site? 
17.5 INTERVIEWS 
17.5.1 Interviews should be conducted for the purpose of finding the cause(s) of the incident or accident. The 


purpose shall be the prevention of accidents and incidents but not to apportion blame or liability. However, the local 
legislation may not provide protection for improper use of witness statements. Investigators should be familiar with the 
local legislative obligations. 


Cockpit crew 


Crew members 


17.5.2 Interviews with the cockpit crew will primarily be the responsibility of the Operations Group and the Human 
Factors Group. The Survival Factors Group should be prepared to participate in the interview or provide questions for 
the other groups. The following areas should be covered. 


Prior to starting the interview, determine whether the crew have been seen by a doctor. 

Document any equipment malfunctions or warnings prior to or during the emergency. 

Document cockpit crew training in emergency responses and evacuation procedures. 

Document the time and method of notification of the emergency to the cabin crew. 

Document any further interaction with the cabin crew. 

Document any communication problems encountered as a result of the locked flight deck door. 
Document the cockpit crew duties and responsibilities during the evacuation. 

Document whether the cockpit crew were able to complete their tasks with respect to the evacuation. 
Document the efforts of the cockpit crew to assist passengers during the evacuation. 


Document how and when the cockpit crew evacuated the aircraft. 
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k) Document any observations the cockpit crew might have regarding the crash/fire response and/or the 


passenger behaviour. 


1) Document the pilot’s recollection of any CRM training conducted by the carrier involving cockpit and 


cabin crew. 


m) Resolve any questions obtained through CVR, DFDR, ATC transcripts or radar records. 


Cabin crew 


17.5.3 Prior to starting the interview, determine whether the crew members have seen a doctor. Interviews with 
the cabin crew will primarily be the responsibility of the Survival Factors Group. Other Groups may wish to participate or 
provide the Survival Factors Group with questions. Each crew member should be given the opportunity to describe, 
without interruption, what happened to him/her. Follow-up questions should be asked as required for clarification 


covering the following areas. 


a) Personal information. 


1) 


2) 


Name, business address, phone number and e-mail address. 

Gender, age, height and weight. 

Occupational experience on the aircraft accident type in hours or years. 
Documentation of cabin crew training for emergency response and evacuations. 
Work category — cabin crew member, purser, lead crew member, etc. 

Other aircraft type on which the crew member is presently qualified. 

Experience as a cabin crew member in years with current and previous carrier. 
Flight and duty schedule during 72 hours prior to the occurrence. 


Food and beverages consumed during 24 hours prior to the occurrence. 


10) Sleep/wake cycle during 7 days prior to the occurrence. 


11) Medical history and current medical condition. 


12) Medications taken at the time of the occurrence. 


13) Medication taken at the time of the interview. 


14) Commute time to the airport. 


15) Document any injuries, when and how they occurred. 
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b) 


Pre-flight/in-flight activities. 


1) 


12) 
13) 
14) 
15) 
16) 
17) 
18) 


19) 


Describe the preflight briefing. What was covered, who took part, who conducted the briefing? 
Describe the pre-flight briefing with the pilots. 

Describe the pre-flight safety checks. 

Describe any cabin systems that were unserviceable at the beginning of or during the flight. 


Describe any interaction with maintenance, ground service personnel, customer service 
personnel and/or the pilots that may be pertinent to the investigation. 


Describe the location in the cabin of any passengers with special needs or children travelling 
alone. 


Describe the procedure for special attention passenger briefing. 

Describe the exit briefing given to passengers. 

Were the briefings done prior to aircraft push back? 

Describe the passenger safety briefing. 

Were the passengers attentive? 

Describe the amount and stowage of carry-on baggage. 

Describe the pre-departure cabin activities and any problems encountered. 
Describe the exit arming procedures. 

Which jump seat did you use for take-off/landing? 

Describe how you were seated for take-off and landing. 

Describe the restraint system and how it was used. 

Describe any pre-take-off/landing procedures to prepare for an emergency. 


Describe the amount of alcohol served before/during the flight. 


Occurrence information. 


1) 
2) 


3) 


Describe how, when and by whom you were advised of the problem. 
Describe the information were you given. 


Describe any problems encountered with the locked flight deck door. 
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qd) 


4) Describe your location in the cabin when you received the information. 
5) Describe how, when and by whom the passengers were advised. 
6) Describe the passengers’ reactions. 
7) Describe the cabin preparation for the occurrence. 
8) Describe if you were able to provide extra briefings to passengers with special needs and children 
travelling alone. 
9) Describe the occurrence. 
10) Describe the impact. 
11) Describe the evacuation commands. 
12) Describe the brace positions for passengers and cabin crew. 
13) Describe your brace position. 
14) Describe the security of the cabin furnishings in your area. 
15) Describe any difficulties you may have had with your seat or restraint device. 
16) Describe any safety equipment used during the cabin preparation. How and why was it used and 
was it effective? 
17) Describe your view of the cabin. If it was obstructed, explain why/how. 
Evacuation. 
1) How did you decide to start the evacuation? 
i) | captain’s orders; 
ii) | personal decision; 
iii) evacuation alarm; 
iv) PA announcement; or 
v) fire fighter’s orders. 
2) Describe the evacuation. 
3) Which exit did you open and was it your assigned exit? 


If you did not open an exit, explain why. 
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5) Did you have a direct view of your primary/secondary exit from your jump seat? 
6) Did you assess the exterior conditions prior to opening your exit? 


7) Did you encounter any problems assessing outside conditions, opening the exit or 
deploying/inflating the evacuation slide? 


8) Did you observe any interior/exterior emergency lights? 

9) Describe the interior/exterior illumination. 

10) Describe the passenger behaviour/reactions during the evacuation. 
11) Did the passengers attempt to take any carry-on baggage with them? 
12) Describe any passenger's assistance during the evacuation. 


13) Describe any problems with the passengers during the evacuation including passengers with 
special needs and children travelling alone. 


14) Approximately how long did the evacuation take? 
15) What is this estimate based on? 
Note.— Time estimates are unreliable unless they can be verified by empirical data. 


16) Were you aware of other cabin crew evacuating the aircraft and did you see which exits they 
used? 


17) Describe any emergency equipment you may have used, how you used it and if it was useful. 
18) Describe the activities of the flight deck crew outside the aircraft. 

19) Describe the activities of the fire fighters. 

20) Describe if and how you were transported to a hospital or medical facility. 

21) How long did the rescue efforts take? 

22) Describe your uniform and its suitability for the evacuation. 


17.5.4 Turbulence, smoke/fire/fumes or contact with water. Should any of these conditions have occurred, the 
following information should be added to the above information. 


a) Turbulence. 
1) Describe your established communication procedures in preparation for expected turbulence. 


2) Describe the communication procedures used in this occurrence. 
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11) 
12) 
13) 


14) 


Did you receive a warning prior to experiencing the turbulence? 
How, when and from whom was the warning given? 

Was the seat belt sign illuminated? If yes, for how long? 

Was an announcement made to the passengers to remain seated? 
Did the passengers obey the signs? 

Were you seated with your seat belt fastened? If not, why not? 
Where were you when the turbulence occurred? 


Were there any problems encountered with stowing equipment before, during or after the 
turbulence occurrence? 


Describe any injuries you received. 
Were you able to assist others after the occurrence? 
Describe any injuries sustained by other crew members/passengers. 


Describe any communication with the cockpit after the occurrence. 


Smoke/fire/fumes in-flight. 


1) 


2) 


6) 


Describe when, where and how you became aware of smoke, fire or fumes in the cabin. 
Describe when, where and how you became aware of fumes in the cabin. 

Describe what you saw, smelled and heard (colour, density, odour). 

Did the conditions increase, decrease or change during the occurrence? 


Did you experience any difficulty breathing? Did you use a PBE or any other type of breathing 
protection? 


Describe the use of any fire fighting equipment. 


Ditching/inadvertent water landing. 


1) 


2) 


Describe when and how you became aware that you were in the water. 


Describe any problems you experienced deploying, inflating and boarding the slide rafts or life 
rafts. 


What type of personal flotation device did you use and from where did you obtain it? 


Did you encounter any problems obtaining or donning the flotation device? 
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5) What personal flotation devices did the passengers use? 
6) Did the passengers have any problems finding or donning their flotation devices? 
7) When did the passengers inflate their life jackets? 
8) Did you take any emergency equipment with you into the raft? 
9) Did you retrieve the ELT and was it deployed? 


10) Who took command of the slide raft/life raft that you boarded? 


11) Were there other crew members in the same raft? 


12) Describe the sea survival procedures that were used. 


13) Describe the rescue operation. 


Training 
17.5.5 Cabin crew documentation should include the following. 
a) Describe your initial and recurrent emergency training. 
b) Did your initial training include any basic instruction in aerodynamics and aircraft performance? 
c) When did you last take recurrent training? 
d) When was your last evacuation drill conducted? Describe the drill/s and how often they are 
conducted. 
e) Describe your fire fighting training. 
f) Describe your initial and recurrent ditching training. 
g) Have you ever participated in a wet ditching drill? If yes, describe the drill. 
h) Describe any practical/nands-on training with respect to emergency equipment. 


Do you participate in Crew Resource Management with pilots and/or other personnel in your 
company? 


Describe this training. 


Do you think your training prepared you for the occurrence? 
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Additional comments 
17.5.6 Where indicated, all cabin crew interviewed should be queried for the following. 


a) Were you offered any Critical Incident Stress Debriefing following the occurrence? If “Yes”, did 
you participate and was it helpful? If “No”, why not? Will you seek additional assistance? 


Note.— Normally there is an initial brief and then follow-up at three and six months. 


b) Based on your experience, can you suggest any improvements to training, procedures or 
equipment? 


c) Do you have anything further to add that might assist in the investigation of this occurrence? 


Passengers 
17.5.7 a) Personal information. 
1) Name, gender, age, height and weight. 
2) Address. 
3) Phone numbers and e-mail address. 
4) Occupation. 
5) Aviation experience. 
6) Seat number and location. 
7) Any disability that could impede egress from the aircraft. 
8) Languages spoken. 
9) Describe any injuries including how and why they were sustained. 


b) Pre-flight preparations. 


= 


) Describe the weight, size and stowage location of your carry-on luggage. 
2) Describe the pre-departure safety briefing. 

3) Who provided it and did you understand the information? 

4) If seated over wing, did you receive an exit row briefing? 

5) What information were you given? 


6) Did you understand the information? 
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7) Did you read the safety briefing card? 
8) Did you understand the information on the card? 
9) Did you note the locations of one or more exits near your seat? 


10) Did you use any method to establish how to find an exit in the dark, i.e. did you count the number 
of seat rows to get to the exit? 


11) Describe any observations of maintenance, ground service personnel, passenger service 
personnel or flight crew that might be pertinent to the investigation. 


12) Describe your clothing and footwear at the time the accident occurred. 
Occurrence information. 

1) How and when did you first become aware that there was a problem? 

2) Where were you when you first became aware that there was a problem? 

3) How did the crew prepare the cabin for the emergency? 

4) Were you given instructions over the P/A system or by an individual crew member? 
5) Were the instructions shouted? 

6) How did you position yourself for impact? 

7) Did you hear any shouted commands? 

8) What did you hear? 

9) Was the information helpful? 

10) Were you travelling with infants/children? 

11) How were they restrained? 

12) Did you use an infant restraint device? 

13) Were there any problems with their seatbelts? Please describe. 

14) How tightly was your seat belt fastened? 

15) Did you have any problems releasing your seat belt? Please describe. 

16) Did you remove your shoes? Did they stay on during the impact and evacuation? 
17) Describe the impact sequence and what happened to you. 


18 


~~ 


Did anything happen to your seat during impact? 
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qd) 


19) Did you remain in the brace position during impact? If not, why not? 

20) Did you remain seated until the aircraft stopped? If not, why not? 

21) Did you observe the actions of any other passengers during the impact sequence? 
Evacuation. 

1) Which exit did you use and why? 

2) Did you encounter any problems reaching your exit? Please describe. 

3) Did you attempt to take anything with you when you left the aircraft? Why? What did you take? 
4) Were you asked to assist with the evacuation? 

5) Did you assist anyone without being asked? 


6) Did you open an exit? If so, which one? Did you encounter any difficulties operating or using the 
exit? 


7) Did you observe the actions of any other passengers? 


8) Did you notice any lights in the cabin? Where were they? Did they assist with your ability to 
evacuate? 


9) Approximately how long did it take you to evacuate the aircraft? 

10) What is this estimate based on? 

11) What did you see/smell/hear during the evacuation? 

12) What did you see when you got out of the aircraft? 

13) How long did it take for the rescue personnel to arrive at the site? 

14) Describe the rescue efforts. 

15) Were you injured? How did the injury occur? 

16) Were you assisted by anyone, i.e. cabin crew, rescue personnel, other passengers? 
17) How were you assisted? Did you require any further assistance? 


Turbulence, smoke/fire/fumes or contact with water. Should any of these conditions have occurred, 
the following information should be added to the above information. 


1) Turbulence. 


i) Where were you when the turbulence occurred? 
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2) 


Was your seatbelt fastened? If not, why not? 


Was the seatbelt sign illuminated? 


iv) Did you hear any announcements regarding seatbelts? If “Yes”, what did you hear? 

v) Who do you think made the announcement, i.e. cabin crew/flight deck crew? 

vi) Were you injured? Describe your injuries. 

vii) Were you given first aid and by whom? 

viii) Were you travelling with an infant? 

ix) How were they restrained? 

x) Were they injured? Describe the injuries. 

xi) Were any announcements made at the beginning of the flight regarding the use of seatbelts 
during the flight? If “Yes”, please describe what you heard. 

Smoke/fire/fumes. 

i) When did you become aware that there was a problem? 

ii) | Where were you when you first became aware of the problem? 

iii) Where were you when you first observed smoke or fire? 

iv) Describe what you saw, smelled and heard, i.e. colour, density, odour, noise. 

v) Did the conditions change during the occurrence? 

vi) Did you experience difficulty breathing? What actions did you take to protect yourself? 

vii) Did you observe any of the in-flight fire fighting procedures? Please describe what you saw 


and heard. 


viii) Did you observe any ground fire fighting procedures? If yes, please describe. 


Ditching/Inadvertent water landing. 


When did you realize that you were going to evacuate into the water? 
What types of flotation devices were available? 

Were you able to find and don a life vest? 

Where was it located? 


Did you experience any problems retrieving it from the stowage? 


Ill-17-24 


Manual of Aircraft Accident and Incident Investigation 





vi) 
vii) 
viii) 


ix) 


xi) 
xii) 
xiii) 
xiv) 
xv) 
xvi) 
xvii) 
xviii) 
xix) 


XX) 


Were you able to put it on? 

When did you inflate the vest? 

Did it work properly? 

If you were travelling with an infant or child, were you provided with an infant/child life vest? 
Did you use a seat bottom cushion for flotation? 

Describe how you used the cushion. Was it effective? 

Did you board a life raft or slide raft? 

Did you experience any difficulties? 

Describe what type of raft/slide raft you boarded. 

Was there any survival equipment in the raft? Was it used? 
How many people were in the raft/slide raft with you? 
Were there any crew members with you? 

Describe the water conditions. 

Describe the weather conditions. 


Describe the rescue efforts. 


4) Additional comments. 


i) 


Were you offered any Critical Incident Stress Debriefing following the occurrence? If “Yes”, 


was it helpful? If “No”, why not? 


ii) 


ili) 


Based on your experience, can you suggest any improvements to procedures or equipment? 


Do you have anything further to add that might assist in the investigation of this occurrence? 


17.5.8 The importance of occupant survival following an accident/incident cannot be emphasized enough. 
Information collected during a Survival Factors investigation can be used to enhance flight safety by increasing the 
survivability of future accidents. In an accident where survival factors are a major issue substantial amounts of 
information will be collected. The scope of the survival aspects investigation depends on the accident. In some accidents 
survivability is a major issue. Survival factors should never be ignored. 


Chapter 18 


PATHOLOGY INVESTIGATION 


18.1 GENERAL 


18.1.1 This chapter is intended as a general guide to an aircraft accident investigator on the contribution that 
medical, pathological and human engineering specialists may be able to make to an accident investigation and the 
nature of the work involved in their contribution. More detailed material is provided for the medical specialists themselves 
in the Manual of Civil Aviation Medicine (Doc 8984) and in other publications which, while technical in content, could be 
of value to aircraft accident investigators interested in this particular field. 


18.1.2 The prime object of the human factors investigation is to obtain evidence as to the cause, sequence and 
effect of the accident through an examination of the operating crew, the cabin attendants and the passengers. 
Coincidently with the investigation, evidence as to identification will automatically emerge particularly if each examination 
is enhanced by the coordinated efforts of the Human Factors Group pathologist, police, odontologists, radiologists, etc. 


18.1.3 Identification of the victims must not be regarded as an end in itself. Identification is an essential part of the 
overall aircraft accident investigation and it is expedient to integrate the identification of bodies with the post-mortem and 
autopsy examinations. It is for this reason that the subject of identification is dealt with in some detail in this chapter. 


18.1.4 The importance of the human factors investigation has been inadequately appreciated in the past; the 
evidence derived from the human beings concerned in an aircraft accident — be they crew or passengers, survivors or 
non-survivors — represents an integral part of the investigation as a whole. The purpose of this introduction and Section 
18.2 is to outline the value of the medical investigation to aircraft accident investigators and to civil aviation 
administrations. It will also be valuable in pre-accident and emergency training in order for the emergency response 
team to better preserve vital accident evidence. 


18.1.5 It is realized that the procedures to be followed and responsibilities will differ considerably according to 
local or national laws, regulations and practices and that in some States the competent judicial authority is responsible 
for the investigation of all cases of sudden death. However, from an aircraft accident investigation point of view the 
objective of the medical investigation should be: 


a) to provide medical evidence of technical value to the Investigator-in-Charge in the reconstruction of 
the accident; and 


b) to provide medical evidence of technical value related to human engineering, survival aspects, etc. 


18.1.6 Generally, the Investigator-in-Charge will appoint a specialist — preferably in aviation medicine and with 
experience in aircraft accident investigation — to the investigation, most likely to the Human Factors Group. When there 
are fatalities, the Investigator-in-Charge should also appoint a pathologist, ideally with experience in aviation pathology 
or at least in forensic pathology, to perform or to observe the autopsy examinations. Fatal accidents are, generally, more 
difficult to investigate than non-fatal accidents and this is why the role of the pathologist is stressed in this chapter. When 
no aviation pathologist is available in the State investigating a major fatal accident, the Investigator-in-Charge should 
consider requesting other States to provide the necessary specialist(s). Regard should also be given to supporting the 
victims of aircraft accidents and their families. Detailed material on this subject is available in Circular 285, Guidance on 
Assistance to Aircraft Accident Victims and their Families. 
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18.1.7 Depending upon whether the accident involves large or small aircraft, the human factors evidence will 
differ mainly in emphasis rather than substance. In either case it will not achieve maximum value in the absence of pre- 
planning on the part of the aviation authority and other local or national authorities. Such pre-planning should be on the 
basis of the largest possible disaster; a small accident merely means utilizing fewer of the available resources. The 
matters for concern are detailed in subsequent sections but may be summarized as follows: 


a) The large non-fatal accident: the plans must be concerned with the provision of rescue equipment, 
with the availability of hospital facilities and with the interview and examination of the crew to 
determine possible medical and psychological factors, and of both crew and passengers with regard to 
injuries and their causes, and escape and survival aspects. 


b) The major fatal accident: the disaster plan will include training in the mapping and recovery of bodies, 
the provision of mortuary and refrigeration facilities and the establishment of a medical team of 
investigators together with an identification secretariat or commission. 


18.1.8 This is a considerable task but the benefits likely to accrue from a human factors investigation are at least 
equal to the benefits derived from any other aspect of the aircraft accident investigation. 


18.2 CONTRIBUTION OF THE PATHOLOGY INVESTIGATION 


Reconstruction of the circumstances 


18.2.1 Some medical evidence relating to the reconstruction of the circumstances of the accident may come from 
surviving crew members or passengers. In the main, however, medical evidence associated with the reconstruction of 
the accident circumstances is associated with the fatal accident. 


18.2.2 In fatal light aircraft accidents the examination of the pilot is likely to contribute most; here the medical 
investigations should be directed to determining or excluding disease and its possible association, and such aspects as 
determining or excluding alcohol, drugs and toxic substances as accident causes. The examination of passengers 
cannot be ignored, however, even in light aircraft; in dual control aircraft one cannot be certain that a “passenger” was 
not flying the aircraft and further, toxicological examination of passengers’ tissues may tend to validate findings in the 
pilot's body such as raised carbon monoxide levels. 


18.2.3 The presence of two or more pilots on the flight deck of larger aircraft makes pilot incapacitation from 
disease or drugs as a cause of a major accident less likely. Although this is not entirely true when the accident has 
occurred at a critical phase of flight such as takeoff or landing, nevertheless the pathologist may often find it appropriate 
in a large accident to concentrate on the search for evidence of conditions likely to affect the whole crew, in particular, 
carbon monoxide or other noxious fumes that may have contaminated the cockpit. It is important to note that carbon 
monoxide poisoning is very uncommon in gas turbine aircraft, but far more likely in aircraft with reciprocating engines, 
because of the amount of the gas in the exhaust of the different types. The pathologist must also seek evidence to 
eliminate or confirm the involvement of a criminal act such as unlawful interference with the operation of the aircraft. A 
full examination of all the operating crew may give valuable evidence about who was controlling the aircraft at the time of 
the crash, and in this respect identification has direct technical value to the investigation as distinct from judicial value. 


18.2.4 In the major fatal aircraft accident, however, there is the possibility of deriving evidence from the cabin 
attendants and passengers; a main concern of this chapter is to illustrate why the opportunity must not be lost. A full 
examination, particularly when it can be based upon previous experience, may reveal evidence as to the sequence of 
events, the stage of flight and the degree of emergency anticipated; the pattern of injuries may indicate clearly the type 
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of accident i.e. fire in flight, structural failure in flight, sudden or gradual deceleration at impact, etc.; and an examination 
of the passengers may be the prime method of demonstrating sabotage as an accident cause. 


Human engineering and survival 


18.2.5 The human factors investigation may provide medical evidence which is of great value in relation to human 
engineering and survival. Such evidence will be equally relevant in both fatal and non-fatal accidents but again there 
may be a difference of emphasis according to whether the accident involves a large or small aircraft. 


18.2.6 In the case of the small aircraft the examination will generally be directed to the pilot(s); however, whether 
the aircraft be large or small, one should consider such factors as the relevance of the type of harness restraint in use, 
the provision or lack of other items of safety equipment, and the injury-producing potential of the controls, instruments 
and other cockpit structures. 


18.2.7 In the case of the transport aircraft accident, interest will inevitably include the passengers, and the 
Survival Factors Group will be searching for evidence of injury resulting from seat structures, with or without adequate 
harness restraint, and the missile effect of contents of the cabin. Medical or pathological evidence will also be available 
as to the adequacy or inadequacy of walkways, exits and survival equipment. 


Identification 


18.2.8 It is apparent that the useful interpretation of human factor findings is dependent upon accurate 
identification of the casualties involved. Identification is, therefore, preeminently a tool of investigation but it also has 
major medico-legal significance and judicial application. The head of the Human Factors Group must be prepared for 
any evidence determined by members of the group as accident investigators, particularly the pathologist, to be used for 
medico-legal purposes. The Human Factors Group will, therefore, have special needs for coordination with local or 
national authorities with particular regard to identification. These needs should be recognized during the pre-planning 
and should not be overlooked during the investigation. There is, however, no conflict of interests. Investigation and 
identification are inter-dependent as recognized in Annex 13 and in the following sections of this chapter they are 
discussed together under the same headings, in particular: 


a) tasks at the accident site; 
b) tasks at the mortuary; and 


c) evidence to be derived from the pathological examination. 


18.3. BRIEFING THE PATHOLOGIST 


18.3.1 Ideally, the appointed pathologist would obtain a complete “case history” before beginning the examination: 
the pathologist should become acquainted with the details of the circumstances of the accident, details of the operating 
crew’s medical and personal histories, be familiar with the internal layout of the cockpit and passenger compartments of 
the aircraft type concerned, and make a thorough examination of the accident site before commencing examination of 
the bodies. Such an approach is rarely, if ever, practicable. The pressures that exist following most fatal aircraft 
accidents are such that examination and disposition of the bodies must be handled as quickly as practicable and 
unnecessary delay avoided. Many factors may necessitate speed; the extreme example is that of a tropical climate with 
no refrigeration facilities. Culture and religion of the victims may also play a role. 
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18.3.2 A practical approach has been found to be for the pathologist to be briefed at the outset by the 
Investigator-in-Charge concerning the salient features of the accident and to be informed whether any particular ideas as 
to the type of accident may have been aroused. This does not have to be a lengthy or detailed briefing but sufficient only 
to allow the pathologist an opportunity to make a special point of searching, during the course of the normal complete 
examination, for supporting or contradictory evidence relative to any other evidence which may already be available to 
the Investigator-in-Charge. At frequent intervals during the investigation the pathologist and the head of the Human 
Factors Group, or the Investigator-in-Charge as appropriate, should confer. The pathologist can thus get an up-to-date 
picture and learn of developments which may bear upon the work and in turn can report any findings which could 
provide a lead for members of other groups. This is the principle of the Group System in which it is essential that the 
human factors team play a full part. 


18.4 TASKS AT THE ACCIDENT SITE 


Facilities and equipment 

18.4.1 The equipment required for locating and recovering the bodies will depend upon the nature of the accident. 
Much of this equipment will need to be provided locally and the value of pre-planning will be reflected in the speed with 
which it is provided. Many accidents occur at or in the vicinity of airports and therefore combined disaster planning by 
aviation and local authorities is particularly important in such areas. Stocks of certain items should be established and 
the availability of other equipment assessed and kept under constant review. 
18.4.2 In accidents which involve collision with houses, factories, etc., heavy equipment such as cranes and 
bulldozers might be required in order to clear the way and to remove the debris so that the bodies can be found. When 
the first sign of a body is uncovered, work must then proceed slowly by hand. Where the aircraft crashes in isolated 
territory such as mountainous districts, deserts or swamps, special equipment might be required; when victims are 
thrown into water, boats and diving equipment may be necessary. 
18.4.3 A list of basic equipment for investigators is to be found in Part | of this Manual; the following items are 
more specifically recommended for recovery of the accident victims, their examination and identification, and should be 
provided in quantities proportionate to the number of victims: 

a) first-aid kits, blankets and transport facilities for survivors; 


b) plastic or canvas bags, burial pouches or coffins for transport of bodies; 


c) strong paper or plastic bags or other containers, one for each body, for safekeeping of personal 
effects; 


d) stakes with numbers and tags; 

e) tags for marking bodies, bags, remains or pieces of equipment or stakes at the site; 
f) ropes, string; 

g) scotch tape; 


h) indelible ink, wax pencils (blue, red); 
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i) rubber gloves, protective clothing, such as aprons, rubber boots, etc., as appropriate. See Hazards at 
Aircraft Accident Sites, Circular 315, for more detailed information on protection equipment; 


j) | photographic equipment, including flash gear, for the specific use of the Human Factors Group; 


k) pocket lens or microscope, microscope slides, syringes and needles; measuring tape, dental wax, 
reagents, antiseptic solutions, etc.; and 


1) suitable containers (plastic bags) and test-tubes (with plugs) for collecting blood, tissue, specimens or 
small pieces of material on which laboratory tests will be made; and suitable preservatives. 


18.4.4 Some of the above items, such as the last two, will normally be required only in the specialized 
establishment in which the bodies of victims will be taken for detailed examination and to which reference is made in 
Section 18.5. 


Procedures to be followed during the recovery phase 


18.4.5 The first responsibility following an aircraft accident is always to give immediate assistance to the injured 
by whatever means can be made available. In the event that life cannot be saved in that particular accident, the next 
responsibilities are to save lives in future accidents and to save lives by trying to prevent future accidents. This is the 
principle underlying the whole investigation of the accident and the basis for the need for close coordination between 
local or national authorities and the Investigator-in-Charge and the investigators, in particular the appointed pathologist. 


18.4.3 Recommendations of the International Criminal Police Organization 


18.4.6 The following suggestions are based on recommendations by the International Criminal Police 
Organization (INTERPOL). The INTERPOL recommendations are based primarily upon mass disasters of types other 
than aircraft accidents; therefore, in the following sub-paragraphs, they have been modified to take account of the 
special needs of a comprehensive medico-pathological investigation of an aircraft disaster. 


a) Bodies should be labeled and photographed in situ at the accident site. The photographs are intended 
as a record of the victims’ circumstances and location at the accident site, the bodies’ attitudes and 
relationships to adjacent objects including other bodies and major portions of wreckage. In addition to 
the photographs, the positions of bodies relative to other bodies and to pieces of aircraft wreckage 
should be mapped and/or the position marked by staking if the terrain is suitable. If necessary, this 
action can be commenced by the police provided the need to preserve and record all evidence of 
possible importance to the medical and technical parts of the accident inquiry is strictly recognized. 
Ideally it should be performed in cooperation with the Investigator-in-Charge and the investigators, in 
particular the pathologist appointed to conduct the medico-pathological investigation if the 
pathologist’s attendance were not unduly delayed. 


b) The bodies of victims should be placed in temporary coffins or such other containers as might be 
available. Many of the types of plastic and canvas bags or burial pouches that are available are 
adequate provided that no loss of content is possible during transit. Polythene sheeting has the 
disadvantage of requiring care in packing if loss in transit is to be avoided; but it can be used with 
care. Labels should be attached to loose articles and detached portions of bodies. They should be 
listed and their location identified with respect to the numbered bodies recorded. 
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c) Examination of bodies should be conducted at the scene only to the extent outlined in a) above, but 
corpses should not be removed until all the procedures recommended have been carried out. Each 
body, the clothes which are on it and the property in that clothing should be transferred intact to a 
container and thence to the mortuary area. 


d) The label attached to a corpse must be numbered in indelible crayon or ink and should be affixed to 
the body itself, not to a stretcher or blanket. It is, however, convenient to attach an additional label 
bearing the same number to the container in which the body is placed for transit. Certain body bags 
have a pocket on the outside to hold such a label. 


e) As stated in c) above, it is best if personal effects are not removed from the corpse at the site. If 
effects fall from a body being placed in a container they should never be replaced but be put in a 
separate container and labelled so as to indicate their probable or almost certain (if this be true) 
association with a particular numbered body. Rescue workers should use extreme caution in 
recovering the bodies and in gathering all personal belongings or property that may belong to the 
deceased, in keeping these with the remains to which they unequivocally belong while they are being 
removed to the mortuary, but in separately packaging and carefully labelling items the ownership of 
which is in any way doubtful. An incorrectly assigned item could cause the identification team a great 
deal of additional work, and it could lead to an error in identification. The location of all loose property, 
clearly shown in relation to the remains near which it was found, should be noted on the label attached 
to each article. 


f) |The bodies of victims should not be dispersed but brought together by the quickest means possible to 
a specialized establishment or, in the absence of such establishment, to the most suitable place 
capable of conserving them. There they can be retained, in refrigerated accommodation if necessary 
and if available, for the detailed and special examinations which should be undertaken to complete the 
identification procedures and at the same time to find evidence relative to the accident investigation. 


18.4.7 The success of the medico-pathological investigation in general and the identification of the victims in 
particular depends upon the thoroughness of the rescue workers more than anyone else for it is their preliminary work at 
the scene which can facilitate the further investigations or jeopardize them. These workers should be thoroughly 
instructed in their task and its importance, but it is strongly urged that the work at the scene should always be supervised 
by the Investigator-in-Charge and the investigators, in particular the appointed pathologist or, in their absence, an 
experienced pathologist and/or police officer. 


18.4.8 In the event that collection and transfer of the bodies to the mortuary has preceded the arrival of the 
Investigator-in-Charge, no harm will have been done provided that the practices outlined above have been followed. 
However, so great is the importance of preserving evidence for the investigation (both the technical and the judicial) that, 
once the bodies are securely housed, detailed examination of any sort must await the arrival of the pathologist. 


18.4.9 The Investigator-in-Charge should not hesitate to use his or her influence with local or national authorities 
to persuade them of the importance of all these matters particularly if the liaison associated with the pre-planning in the 
event of an accident failed to produce standing arrangements. 
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18.5 TASKS AT THE MORTUARY 


Facilities 


18.5.1 A mortuary with the necessary facilities or a medico-legal institute might be available in the vicinity of many 
airports. Otherwise, a survey should be undertaken of premises, such as the basement of airport buildings, which may 
be suitable for use as a mortuary in case of accident, and the necessary equipment should be placed in readiness for 
use in an emergency. Local authorities not in the vicinity of airports but formulating aircraft disaster plans might consider 
buildings such as public halls, gymnasiums, or large commercial storage premises which, if not empty, could be vacated 
at short notice. Perhaps the prime requisites are space, privacy, light and running water, in that order of importance. In 
addition to the space needed for the work of examining bodies, separate rooms should be available where remains can 
be viewed, if necessary, by relatives and others. Separate accommodation, preferably close at hand, is needed for the 
interview of relatives and witnesses and for clerical work. It is extremely important also to have a room close to the 
mortuary which can act as a communications centre. 


18.5.2 Depending upon climatic conditions, consideration should be given to the availability of refrigeration 
facilities. Refrigerated storage of bodies pending examination is necessary except in the coldest climates, especially if 
there are large numbers and their examination will take many days. Rarely will there be sufficient permanent refrigerated 
mortuary accommodation near the site of a large accident. When there is not, the best solution may be to hire 
refrigerated trucks which may be parked within the main mortuary precincts. Should such trucks not be available, block 
ice may be used, but this is a relatively inefficient means of keeping bodies cool and supplies in sufficient quantity may 
be difficult to obtain. Occasionally spacious refrigerated accommodation may be available in some factory or other 
commercial building within a reasonable distance of the main mortuary and this could be utilized for temporary storage. 


18.5.3 If no facilities can be made available where the remains can be kept cool in tropical climates, temporary 
burial might become necessary until arrangements can be made for onward transportation to a place suitable for the 
detailed investigation. In this case it is essential that every item of information that can be obtained at the scene of the 
accident and from remains which might assist in identification or the explanation of the accident be immediately obtained 
and carefully recorded. In an isolated region where no facilities are available it may be possible, after consultation and 
coordination with the responsible local or national authorities, to return the remains of all victims to the point of origin of 
the flight (or some other mutually convenient location) for examination, identification and disposal. It should be noted that 
the transport of corpses is subject to certain conditions and regulations. Contracting States, in the case of aircraft 
accidents, should ensure cooperation as specified in Annex 12. 


18.5.4 The pathologist within the Human Factors Group should be aware of the extent to which the assistance of 
a medico-legal or pathological institute will be required for special medical, biological or chemical tests relative to 
identification or to other aspects of the investigation and the pathologist should collect specimens accordingly. Again the 
importance of coordination with the local or national authorities is stressed. 


18.5.5 A medical institute or funeral director may be able to provide facilities for embalming. Some airlines retain a 
firm of funeral directors and they arrange repatriation and ultimate disposal as appropriate. It is suggested that aviation 
and local authorities should ascertain the nearest institutes and airlines capable of providing relevant services, and the 
amount of help they could give if required. 
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Identification of the dead 
Principles 


18.5.6 Identification of the dead is of great importance for sociological and legal reasons to the families of the 
deceased. It permits the issue of the certificate of death necessary to avoid the serious legal consequences and 
complications in certain States for the next of kin of a missing person. In some States it would be usual for bodies to be 
released for pathological examination for accident investigation purposes only after the examination by the judicial 
authority for identification purposes had been completed since the responsibility for identification of the victims of a mass 
disaster is often considered by States to be separate from any technical investigation into that disaster. This may be 
satisfactory following certain types of accident or natural disaster but in aircraft accident investigation it is highly 
desirable that the work of identification of the victims be closely coordinated with the pathological examination of those 
victims, for it is essential to the interpretation of the pathological and the technical findings in relation to the accident. 


18.5.7 It is always important, for example, to the technical investigation to identify and establish the location of the 
crew at the time of the accident, and whether or not any other person was in a location likely to have affected the flight 
and, if so, his identity: it is not always practicable, whether the body be that of a crew member or a passenger, to 
differentiate between the medical evidence gained for judicial identification and that gained for consideration by the 
Human Factors Group. 


18.5.8 Damage to bodies from accident forces and fire is often such that only specialist examination of the bodies 
by pathologists, dentists, radiologists and other experts will lead to their identification. An uncoordinated effort between 
local or national authorities and the Human Factors Group is unsatisfactory on two counts. First, evidence essential to 
the aircraft accident investigation may unwittingly be destroyed and, second, to seek help from the Human Factors 
Group only when difficulties arise often complicates the task. 


18.5.9 Although procedures differ according to local or national laws, regulations and practices, where such local 
customs are seriously at variance with the principles set out in this chapter, national and local authorities should be 
urged to modify their practices as far as they can in the case of aircraft accidents in the interests of furthering 
international air safety. 


18.5.10 It is strongly recommended that on all occasions the local or national authorities should seek the 
cooperation of the pathologist appointed by the Investigator-in-Charge. If that pathologist is one experienced in aviation 
pathology, that is the investigation of fatal aircraft accidents, that pathologist will also be expert in matters of 
identification. Failing the availability of such a person, a forensic pathologist might be enlisted to assist. Although a 
forensic pathologist's experience of aircraft accidents may not be great, such a person will have the benefit of the 
aviation experience of other members of the Human Factors Group and will have been trained both in identification 
procedures and in the examination of the bodies of those who have died a violent and unnatural death, with a view to 
contributing to the explanation of the circumstances which led to death. An identification division such as the police may 
be able to help with identification problems themselves, but will not be competent to pursue the wider comprehensive 
search for medical evidence relative to the technical investigation of the accident which is so very important. 


18.5.11 An identification commission might usefully be appointed, as is the practice in some States, comprising the 
pathologist, a police officer or person from the judicial authority with experience of identification, plus such other 
specialists (odontologists, anthropologists, radiologists, etc.) as circumstances permit or require. If possible, the 
pathologist should be chairperson of such a commission. Otherwise there arises the danger of the two aspects of the 
medico/pathological investigation becoming separated and identification being pursued solely as an end in itself and to 
the exclusion of the accident investigation aspects. The chairperson of such a commission may be charged with 
deciding, with the help of the other members, when evidence of identification is conclusive or may be required to advise 
the local judicial authority, or a coroner and jury of what evidence has been found so that a legal official may sign 
certificates of identification; these details are a matter of local procedure and custom. 
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Identification procedures 


18.5.12 There is a great deal to commend the procedure whereby a team led by pathologists (including the Human 
Factors Group pathologist(s)) and police officers or other relevant judicial authority, with clerical assistants, make a 
single joint thorough examination of each body in turn. The steps in this task are outlined below; greater detail is 
discussed in the relevant chapters of the Manual of Civil Aviation Medicine (Doc 8984). 


18.5.13 Both the judicial authority and the pathologist have an interest in the clothing present and its contents. The 
evidence therein may lead to identification (laundry marks, distinctive designs, etc.); it may be significant with regard to 
the accident (drugs or a doctor’s prescription in a flight crew member’s pocket, or a letter in a passenger's pocket, 
indicating a disturbed, perhaps suicidal state of mind). Stains made by vomitus or food may give clues as to the degree 
of emergency; tears in clothing may indicate the cause of death and it is essential that there can be no confusion 
between such tears and those made by the examiner. When clothing has been removed, fully described and catalogued 
in the records relating to the body in question, both the judicial authority and the pathologist can observe the external 
bodily evidence; again this evidence may lead to identification (surgical scars or tattoos, etc.) or be of significance with 
regard to the accident itself (e.g. shrapnel injuries from an explosive device). Radiographs should be taken at this stage 
if facilities are available, their number and the areas of a body selected will depend upon the need to search for evidence 
of sabotage in the given accident and the need to pursue, if there be a paucity of other evidence, radiographic evidence 
of identity. 


18.5.14 Thereafter the pathologist should proceed with the full internal examination and collection of specimens of 
tissue for special laboratory examination and DNA matching. The special laboratory examinations may be histological, 
designed to reveal microscopic disease or evidence of the timing of death, toxicological in a search for the presence of 
alcohol, drugs or noxious substances such as carbon monoxide and, possibly, serological with a view to determining 
blood groups that might assist in identification. DNA matching is useful in identifying victims, as we inherit half of our 
DNA from each parent and, therefore, a part match from the parent of a missing person can reveal the relationship of an 
unidentified body. DNA matching has revolutionized the solving of crimes in forensic science. For identification of victims, 
samples that have been taken from a body can now be compared with a sample of hair, for instance, or samples in DNA 
databases. A match of samples will prove the identity of a victim. However, DNA matching has been subject to a lot of 
criticism, especially when used as evidence in a court of law. 


18.5.15 Photographic records of the body are highly desirable as are photographs of any possibly significant 
abnormalities noted in the external or internal examinations of the bodies. The number of the body concerned should be 
clearly seen in every photograph taken. 


18.5.16 Provided that the judicial authority and the pathologist(s) have carried out a thorough comprehensive 
examination, including making a full record of findings and fully labelling and carefully preserving all suitable material 
evidence for further reference and for laboratory tests or analysis, the bodies may then be placed in caskets and, if 
essential, embalmed. It is, however, advisable that individual bodies should not be disposed of finally until the 
pathological process of identification and investigation is complete with respect to the accident as a whole and, in view of 
the possible need to re-examine bodies, the caskets should be left in such a state that they can be reopened if 
necessary. 


18.5.17 In a large accident with many fatalities the investigations are likely to take many days. In these 
circumstances, it is essential that the amount of work done in the mortuary is controlled; fatigue must be minimized but, 
at the same time, the major observers must remain unchanged until the end. It is usually possible therefore for the 
pathologist and judicial authority to pay some attention to the paperwork of identification after the day’s autopsies. 
Identification basically depends upon correlation of information about a known person with evidence found from an 
examination of a body (see sub-section 18.5.2.4); it is necessary, therefore, for an organization to be instituted for the 
collection of information about the persons aboard the aircraft. 


Iil-18-10 Manual of Aircraft Accident and Incident Investigation 





The gathering of information about those believed killed 


18.5.18 Identification of the majority of bodies following an aircraft accident often depends upon the availability of 
information about those on board. Some information may be available from the airline concerned which should provide a 
passenger list as soon as possible with additional details, if available, such as seat occupied, origin and destination, 
business or home address, ticket number and baggage. 


18.5.19 The most profitable source of information will usually be relatives or close friends of the deceased and an 
information service should be instituted without delay after an aircraft accident. Airlines should include in their disaster 
plans arrangements for setting up an information service as soon as notification is received that a disaster has overtaken 
one of their aircraft. In at least one State the airlines delegate this task to a firm of funeral directors who are retained 
primarily for the purpose of arranging the ultimate disposal of bodies. When no such service is provided by the airline 
involved, ad hoc arrangements should be made through police, Red Cross or similar organizations; the pre-planning for 
the possibility of an accident must envisage this contingency. The utmost tact and sympathetic understanding must, of 
course, be shown by those engaged in this work in dealing with relatives. 


18.5.20 It is essential that relatives or friends are contacted as soon as possible, usually by telephone, using the 
passenger list and addresses supplied by the airline. Full details should be collected from these contacts about the 
physical characteristics of the passenger or crew member, his/her age, clothing and personal possessions. The names 
of his/her doctor and dentist should be recorded if known; both these persons should be contacted for further information 
about physical features with particular reference to any history of surgical operations, current disease, blood group, etc.; 
and possibly most important of all, full details are required of the odontological state. The dentist should be asked to 
supplement any information given by telephone, by sending record cards and dental X-rays to the information collecting 
centre for urgent onward transmission to those examining the bodies in the disaster mortuary. A good photograph of the 
deceased may sometimes be very helpful, and depending upon the country of origin of the deceased, civil identification 
files might provide fingerprints and further personal data. 


18.5.21 There is an infinite variety of items of information about a person that could provide a clue to the identity of 
his/her body. The sort of information outlined above would be sufficient to permit identification in the majority of cases. If 
one or more bodies remain unidentified, further help may be required from the appropriate relatives or friends. This may 
take the form of additional information on particular matters revealed by the examinations of the bodies still to be 
identified, or may involve relatives being asked if they can recognize fragments of clothing or various personal 
possessions. It must never be forgotten that visual recognition, be it of a traumatized or burnt body, or a piece of 
garment or other article, may be erroneous. Many incorrect visual identifications have been made both in a negative and 
positive sense by distraught relatives. When a body is badly mutilated, visual identification should be regarded only as a 
clue to identity and corroborative evidence should be sought. Whenever any bodily remains are presented to relatives, 
this should be done under conditions giving due deference to both the deceased and to the relatives themselves, taking 
into account, whenever possible, the deceased’s religion and the funeral rites prescribed by it. 


Comparison of records 


18.5.22 The task of comparing the findings in the bodies with the information provided about those believed to 
have been on board the aircraft is straightforward but can be time consuming. It can be pursued by clerical assistants 
while the work of examining the bodies continues but any tentative results obtained must be checked by those appointed 
to make the final decision about the acceptability of the evidence in each case. Since the identification of bodies is 
essential for sociological and legal reasons and important (sometimes essential) to the Human Factors Group 
investigation of the accident, the pathologist must be closely involved in the final decisions; as suggested previously it is 
desirable that the pathologist be the chairperson of any identification group or commission. 


18.5.23 One State has found in practice that if the forms used to record findings and information are coloured, or 
clearly differentiated in some other way, the work of comparison is facilitated. 
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18.5.24 It is convenient to deal first with bodies having a direct clue to specific identity available such as a name on 
clothing or in documents. Next, one can conveniently turn to those records which do not have so specific a clue to 
identity. For example, a male body may have retained fragments of crew-type uniform but without an indication of rank. 
One by one it will be possible to exclude the identity of the body as that of a particular crew member until positive points 
of comparison are found sufficient for firm positive identification. 


18.5.25 As the process continues attention should be given to records having no direct immediate clue to identity 
but nevertheless having some unusual feature which may be taken as a clue upon which to concentrate; this might be a 
distinctive tattoo, an old amputation, an unusual dental prosthesis, or perhaps special or distinctive dental records. Many 
exclusions can be made quite rapidly, but occasionally a record justifying more careful comparison of additional features 
will be found before an exclusion can be made. In due course the information records will be correlated with the 
description of the particular feature, and comparison of other details about the body and the known person will be found 
to confirm identity. 


18.5.26 The easier identifications should be made first, leaving until later those which may be more difficult 
because the bodies have revealed fewer clues to identity. When this later stage is reached and the volume of the 
records has been reduced, it will be necessary to painstakingly compare the records of each body with the records of 
each known person of appropriate sex, excluding identity if possible. Often at this stage an appraisal of information 
available will suggest that a body could be that of one of two or more passengers and differentiation may be possible 
only if additional information is sought from the relatives of the particular persons believed to be involved. 


Histology (microscopic analysis) 


18.5.27 There are many reasons for performing histological examinations on tissues of air accident victims, 
including the detection of pathology: 


a) indicating the presence of causal or contributory disease states in flight crew; 
b) influencing survivability or egress; 
c) providing possible indication of drug usage through fixed tissue reactions; 


d) corroborating evidence of severe artefactual change such as putrefaction and fermentation with 
bacterial growth producing (or reducing) ethanol concentrations; and 


e) providing an indication of disease prevalence for aeromedical research. 


18.5.28 Emphasis should be placed on obtaining well labelled samples from the major organ systems and well 
documented specimens of specific lesions or areas of artefactual change. Precise descriptions are extremely important. 
All specimens should be immediately preserved in a container of 10 per cent buffered formalin solution. 


18.5.29 While it is beyond the scope of this section to comprehensively review the broad field of histology, the 
necessity to sample specific sites or organs must be emphasized. The arteries of the heart and the heart muscle itself 
should be examined. Main cardiac vessels should be serially sectioned to detect the presence of occlusal disease. 
Similarly, the detection of cardiomyopathy requires multiple cardiac sections. Histological examination of the liver may 
reveal a variety of conditions ranging from fatty liver to cirrhosis. Microscopic changes in this organ could provide the 
only indication of ethanol abuse or drug use. Pulmonary embolization may provide vital information concerning 
survivability and the timing of death. Soot in the airways and the alveoli lungs will indicate survivability in conditions of 
post impact fire. 
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18.5.30 As well as taking specimens from all major organs, any suspected abnormality, including tumour growth, 
should automatically be sampled. 

Toxicology (study of poisons) 

18.5.31 The adequate toxicological investigation of tissue and fluid specimens from air accident victims requires a 
careful examination for the presence of prescription and over-the-counter medicines and illicit drugs, substances of 
social use and abuse, environmental contaminants and toxins as well as the detection and discrimination of artefactual 
changes such as the production of ethanol due to post impact fermentation. The range of tests will ideally be broad and 
the sensitivity at the therapeutic and sub-therapeutic level. Since, in many instances, physical trauma is severe, 
toxicological examination may provide the only evidence of the existence of disease states that could produce slow or 


sudden incapacitation such as hypertension, epilepsy, etc. 


18.5.32 If possible, examinations should be carried out by a central reference laboratory which will have developed 
methods specific for air accident services as opposed to general forensic testing. 


18.5.33 A variety of tissues and fluids are required for successful testing. Due to the high impact forces often 
involved, fluids may not be available, but adequate quantities of blood from three separate sites, sterile urine from an 
unpunctured bladder, bile (from the gall bladder) and vitreous humour (from the eye) are all extremely useful to the 
toxicologist. The tests commonly performed on usually available fluids are as follows. 
Blood 

18.5.34 Qualitative and quantitative analyses for: 

a) ethanol; 

b) other alcohols, solvents, fuels, hydraulic fluids, etc.; 

c) carbon monoxide; 

d) hydrogen cyanide; 

e) delta-9-THC and metabolites ("marijuana"); 


f) gas chromatography-mass spectrometry (GC MS) screen and quantitation for medicines and drugs 
and their metabolites; 


g) GCMS screen and quantitation of pesticides, herbicides; 
h) High Performance Liquid Chromatography (HPLC) screen and quantitation of medicines and drugs; 
i) radioimmunoassay (RIA) analyses when indicated; and 


j) enzyme labelled immunoassay (EMIT) analyses of medicines. 
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Urine 
18.5.35 Qualitative and quantitative analyses for: 
a) ethanol; 


b) other alcohols and solvents; 

c) GCMS screen for medicines, drugs and their metabolites; 
d) GCMS screen for pesticides, herbicides, etc.; 

e) HPLC screen for medicines and drugs; 


f) RIA screen of digoxin, various antibiotics, THC metabolites, amphetamines, barbiturates, morphines 
and cocaine; and 


g) EMIT screen for illicit drugs. 


18.5.36 Specimens should be uncontaminated if possible and preserved as indicated. Prevention of bacterial or 
fungal growth is especially important in the examination for the presence of ethanol. The rationale behind toxicological 
testing should not require much elaboration. However, some pertinent points will be emphasized. 


18.5.37 The detection of some classes of medicines such as tranquillizers and illicit compounds may indicate the 
need to investigate the victim's psychological status. Psychomotor, perceptual or judgemental performance decrements 
may result from drug ingestion or accidental exposure to a variety of environmental toxins. Samples should be obtained 
from all accident victims, if possible. Specimens from passengers may function as controls for samples obtained from 
flight crew and provide valuable evidence as to, for example, the presence of fermentation producing ethanol. 


18.5.38 Fire patterns may be discerned through the detection of distribution patterns in the levels of hydrogen 
cyanide or carbon monoxide in cabin attendants and passengers. Carbon monoxide in flight crew may suggest a causal 
contamination problem due possibly to faulty heat exchangers. 


18.5.39 Victims of crop spraying accidents should be screened for the presence of pesticides or herbicides and the 
inhibition of cholinesterase. Accident investigators should be warned of the dangers of contamination in investigating 
agricultural accidents and be given adequate protective suits and equipment. They too should be tested if they 
experience symptoms. 


18.6 EVIDENCE TO BE DERIVED FROM THE PATHOLOGICAL EXAMINATION 


Detection of disease or impaired efficiency in the operating crew 


18.6.1 As the joint examination of a body proceeds, the identity of that body may become quickly evident and it 
may be appreciated that it is, or almost certainly is, a member of the operating crew. If this is so, the pathologist's 
examination should be especially detailed from the point of view of detection of disease or impaired efficiency. If the 
operating crew have not yet been identified, and the possibility cannot be excluded that an unidentified body may be that 
of a crew member, the examination of that body must be as complete as if it were known to be that of a pilot. 
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18.6.2 In this case, the pathologist should make an especially careful search for evidence of pre-existing disease 
which could have caused sudden collapse or death or which could have lowered efficiency in general terms and the 
pathologist should also seek evidence of impaired function due to alcohol, drugs or environmental contaminants such as 
carbon monoxide. 


18.6.3 To this end, the autopsy must include sampling of all major organs for microscopic examination and of 
blood and urine and selected tissues for chemical examination. It will generally be possible for the pathologist to obtain 
supplies of the fixative solution needed for preservation of the tissue for microscopic investigation (10 per cent 
formaldehyde); problems may however be encountered as to suitable containers and storage of samples for chemical 
examination. These samples cannot be preserved with fixative solutions and must be frozen; not all States have 
laboratories with facilities for the sophisticated analyses that may be required. It may be considered advisable, therefore, 
subject to the agreement of local or national authorities, and coordination through the Investigator-in-Charge, for such 
specimens to be sent to one of the specialized laboratories that are available for this kind of work in certain States. 


18.6.4 It is important for the investigator to realize that, as in other areas of the accident investigation, evidence 
that a medical abnormality is present in a pilot is a long way from proof that that abnormality was directly connected with 
the accident. A pilot may be shown to have disease which could have caused sudden collapse or death. It is rarely 
possible to find medical evidence which shows unequivocally that disease did cause collapse or death; that it probably 
did so is a conclusion which can normally be reached only after correlation of all the evidence adduced by all the 
specialized investigating groups, not merely that of the Human Factors Group. 


The examination of passengers and cabin attendants 


18.6.5 The volume of work involved in an accident with a large number of fatalities dictates that the autopsy 
examinations and organ and tissue sampling of bodies known to be those of passengers should be less extensive than 
for the operating crew on the flight deck or in the cockpit. Nevertheless, there are certain points which should not be 
overlooked in the examination of any body. 


18.6.6 Sufficiently detailed examination and sampling of these bodies are required to provide, in addition to the 
precise cause of death: 


a) an estimate of deceleration forces, derived from the state of the heart, aorta, diaphragm, liver and 
spleen together with the presence of fractures in sternum, spine and pelvis; 


b) an assessment of any evidence of seat belt injury and associated cranio-facial damage; 


c) evidence of survival in fire as shown by the presence of raised carboxy-haemoglobin levels in blood or 
tissues; 


d) the presence of microscopic changes in the lungs relevant to ante-mortem injury, to life during fire, 
and possibly to such medico-legal questions as survivorship which may subsequently arise; and 


e) for medico-legal reasons note must also be taken of the presence of any pre-existing disease if 
subsequent compensation claims are to be settled with equity. 


18.6.7 Examination of the bodies of passengers can establish a pattern of injuries. Such a pattern may be uniform 
or discordant. A uniform pattern indicates that all the passengers were subjected to much the same type and degree of 
force. A typical example is the combination of cranio-facial damage, seat belt injury and crushing of the lower legs 
associated with the classic crash situation with passengers tied-down with seat belts. Much additional information may 
be derived by comparing the pattern of injuries in the passengers with the pattern in the cabin crew, e.g. were the cabin 
attendants braced for an emergency or were they in their normal operating conditions. 
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18.6.8 In the discordant pattern, one group of passengers may show injuries distinctive from the remainder. This 
could indicate some unusual incident and the interpretation of the findings rests to a large extent on accurate 
identification and location in the aircraft in accordance with the passenger seating plan. The possibility of a single body 
showing a deviation from the norm must always be remembered as it may well be that it is only by this means that a 
case of sabotage or unlawful interference with the operation of the aircraft is disclosed. 


Correlation with the aircraft wreckage examination 
The cockpit 


18.6.9 Correlation between the degree of cockpit damage and the degree of injury to the pilot is essential. 
Anomalous findings may give a clue to such accident causes as failure of the automatic pilot or of attempted interference 
with the normal operation of the aircraft. Injuries should be related to specific items of equipment in the cockpit. To this 
end a search should be made for the presence of blood and other tissues on the seats, instruments and control columns. 
In certain circumstances, it may be necessary to identify such evidence as being related to specific flight crew members 
or, conceivably, to show that the tissues are not human, for example, evidence of bird strike. The damage to and the 
general status of the flight crew seats and safety harness should be recorded as being pertinent to the reconstruction of 
events in the cockpit at the time of the accident, immediately afterwards, and to the possibilities of survival and escape. 


The passenger compartment 


18.6.10 A detailed examination and description of all seats, their attachments, seat belts, and other safety 
equipment and surrounding structures should be made. It is a prerequisite to a survivability study. Displacement of 
fasteners and evidence on the belts themselves may give an indication of the forces involved. The size of fastened but 
torn belts should always be measured. It might be possible to deduce the size of the seat occupant from such 
measurement although it should be borne in mind that seat belt adjustments may vary considerably. Of greater 
importance, the overall tightness of belts should enable the investigator to distinguish between a cabin which has been 
prepared for an emergency landing and one in which the passengers have been sitting with their belts lightly fastened as 
a routine. Findings of this nature must certainly be correlated with passenger seating plans when available and with the 
results of the autopsy examinations. When seating plans are not available and when local or national authorities have 
removed bodies but did not record their location, clues may often be discovered as to the seating of passengers; for 
example, a book or handbag found in the compartment on a seat back will suggest a probable location of its owner. 
Fragments of fabric, fused to aircraft structure, compared with clothing removed from bodies may well permit deductions 
about the location of bodies, at least where the bodies came to rest, if not their seat locations. 


The nature and cause of injuries and their timing 


18.6.11 This refers in particular to a single major lethal injury sustained by a victim or to potentially incapacitating 
injuries which would have prevented a conscious and otherwise capable person from effecting his or her own escape. 
An assessment of the nature and cause of injuries is required so that consideration can be given to appraising safety 
features within the aircraft and improving them. Examples include penetrating head injuries or crushing fractures of the 
lower legs, both of which may indicate an unsatisfactory design of the back of the seats in relation to these situated 
immediately behind them. 


18.6.12 The causes of unusual types of injury need to be fully examined. On more than one occasion the 
conclusion was reached that the pilot was actually controlling (pilot flying) the aircraft when it crashed, based upon the 
nature of the injuries to the hands and wrists or feet and ankles as determined both by naked eye examination at 
autopsy and by radiographs. 


Ill-18-16 Manual of Aircraft Accident and Incident Investigation 





18.6.13 Sabotage and the possible injuries due to blast or shrapnel from explosive devices must not be missed. 
Tissues from around any such suspect wounds should be preserved by the pathologist for laboratory analysis for the 
appropriate trace evidence. Injuries so caused will be reflected in damage to the clothing; the dangers of premature 
removal of clothing purely for the purpose of identification are, thereby, emphasized. 


18.6.14 Radiographs are especially important in cases of suspected sabotage and any suggestion of foul play 
should indicate a need for extensive use of X-ray examination. This is a good example of the importance of using special 
techniques in the various aspects of the investigation. The more radiographs can be used, the less time need be spent 
at the autopsy table in assessing skeletal injuries, for a permanent record of these will be provided by the films. 
Simultaneously, the radiographs may reveal foreign bodies, or skeletal abnormalities which are of value in the process of 
identification. 


The determination of the cause of death of each person 


18.6.15 Many of the bodies from an air crash will be extensively damaged by excessive forces and by burns. It is 
tempting for those not aware of the value of the pathological contribution to an aircraft accident investigation to ascribe 
death to burning or to multiple injuries on the basis of a superficial external post-mortem examination. A conflagration 
produces so many additional factors that such an analysis represents little more than guess work; moreover, a 
superficial examination fails to distinguish between ante-mortem and post-mortem injury. It is important to determine, if it 
is at all possible, the precise cause of death in each case in relation both to the technical aspects of the accident 
investigation and to later medico-legal problems. A few examples are given to illustrate the essential nature of a full 
internal autopsy: 


a) Inthe event of the death of a pilot from heart disease whilst at the controls, a resultant crash may 
cause multiple injuries which, in the absence of internal examination, might be accepted as the cause 
of death. Obviously in this case the evidence important to the technical accident investigation would 
be missed. 


b) Ifa passenger sustained a severe head injury of lethal severity important conclusions may be drawn 
as to the survivability of his environment. If, however, internal examination showed he in fact died from 
burning, the head injury may be ascribable to the effects of heat and the interpretation will be quite 
different. 


c) A husband and wife may both appear to have sustained multiple injuries and incineration. But if one 
has actually died from asphyxia and the other from injury it could be held that the former survived the 
latter, with far reaching medico-legal implications. Of importance to the technical accident investigation 


would be the evidence that one may have survived the impact, therefore the investigation would 
continue into the human engineering and survival aspects. 


18.7 RELEASE OF HUMAN REMAINS AND PERSONAL PROPERTY 


18.7.1 Although it is preferable to retain all bodies either until all have been identified or until no further 
identifications are possible, bodies should be released to the local or national authorities as soon as possible provided: 


a) all the information relevant to the investigation has been derived from the cadaver; and 


b) there is no possible doubt as to the identity of a body. 
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18.7.2 After identification of all bodies has been established and there is no further need to retain bodies from the 
point of view of the accident investigation, it is normally the responsibility of the local or national authorities to return 
them to their families with a suitable identification notice and death certificate. (Where repatriation is required, additional 
permits and certificates might have to be obtained permitting the transport of the bodies or remains to other localities, 
districts or States.) 


18.8 THE SURVIVED ACCIDENT 


18.8.1 Generally, this is a more straightforward matter than the accident in which all the aircraft occupants were 
killed for it largely involves the examination of living and probably cooperative subjects. Essentially the Human Factors 
Group will be looking for the same type of evidence as that derived from the pathological examination of those killed 
(see Sections 18.6.1 to 18.6.4). 


18.8.2 A medical examination, preferably by an aviation medical specialist or qualified designated medical 
examiner, should be made on surviving flight crew members to determine whether any physical, physiological or 
psychological factors in the operating crew had a bearing on the circumstances of the accident. It might well be desirable 
for blood and/or urine samples to be taken for analysis both for the presence of therapeutic substances and to help to 
determine whether any abnormal state such as hypoglycaemia may have been present. Before taking such specimens, 
however, the investigator should ensure that there are no local legal contra-indications; the investigator should also have 
the consent of the subject and would be well advised to explain the purpose of the tests before undertaking them. 


18.8.3 The crew should be interviewed but this should be coordinated through the Investigator-in-Charge to 
ensure that there is no undue duplication because of the needs of the various Groups. 


18.8.4 A detailed record should be made of injuries to all occupants with an assessment of their cause; the 
findings must be collated with their seat position, or location in the aircraft, and adjacent environment in order that 
preventive action such as redesign may be considered. 


18.8.5 If the aircraft has been evacuated in the presence of fire or similar hazard (e.g. sinking in the case of a 
ditching) a full account of each person’s escape is a valuable contribution to an assessment of factors influencing 
success or failure. 


18.8.6 As the aim of accident investigation is prevention, attention should also be given to the psychological 
effects of the accident upon the flight crew before they are allowed to return to flying duties. 


18.9 OTHER ASPECTS OF THE PATHOLOGY INVESTIGATION 


Flight crew medical and personal records — Basic mental and physical health 


18.9.1 The medical records of the flight crew must be studied to determine whether any condition was known to 
exist which might have precluded their successful completion of the demanded task in the prevailing circumstances. 
Particular attention should be given to any condition likely to have led to incapacitation in flight or to a deterioration in 
fitness and performance. The possible causes of incapacitation or lowered efficiency of performance encompass, 
theoretically, the range of the diseases of humanity but, with adequate medical supervision of crews, gross abnormalities 
are unlikely to be present. 


Iil-18-18 Manual of Aircraft Accident and Incident Investigation 





18.9.2 Any information obtained from the medical records must be correlated with the pathological findings. Many 
functional abnormalities are not demonstrable at autopsy, epilepsy being the prime example. Visual and auditory acuity 
of the crew should also be noted but, again, it will be the essentially negative pathological findings in an accident 
suspected of having a human factors cause which will focus attention on these systems. 


18.9.3 In certain circumstances, the flight crew background should be investigated and this will include 
consideration of such matters as motivation for flying, general intelligence, emotional stability, character and behaviour. 
Again, however, well-documented abnormalities of this sort are scarcely compatible with modern flight crew selection 
methods and it may well be that information obtained from friends, relatives, acquaintances, supervisors, instructors, 
personal physicians and other observers as to both the recent activities and attitudes of the flight crew and to their long- 
term personal and flying habits, general health and ordinary behaviour may provide information which is of far greater 
value. 


18.9.4 The recognition and investigation of the psycho-physiological elements underlying many accident causes 
have not always been given the proper degree of attention. Human elements of perception, judgment, decision, morale, 
motivation, ageing, fatigue, and incapacitation are often relatively intangible, yet highly pertinent variables. Even when 
detected, they are difficult to measure and document and it should be emphasized that a positive association between 
any such abnormality discovered and the cause of the accident can seldom, if ever, be better than conjecture. Despite 
these difficulties, every effort must be made to investigate and report upon such human factors as fully as possible. 


The problems of the particular flight 


18.9.5 Many matters which are not of a medical nature may be pertinent to the Human Factors Group and it is 
here that a close liaison with the Operations Group is essential. Some of the general problems of this type include: 


a) the flight plan — with particular reference to instructions given and deviations made from those 
instructions; 


b) the flight equipment — ranging from items such as the aircraft type, to cockpit layout, mechanisms for 
cabin pressurization, ventilation and temperature control; 


c) the navigation aids — particularly whether they were used to their full extent; 


d) the flight environment and flight phase — which should include a consideration of the possible 
presence of fumes from the engine fluids and fuel and also of toxic substances from the cargo; and 


e) assessment of the workload of the crew at the time of the accident. 


18.9.6 The importance of this information to the Human Factors Group is essentially to guide them into significant 
areas of investigation on their own account. For example, a deviation from the flight path might indicate a need for an 
examination for carbon monoxide intoxication; a suspect pressurization system might indicate a need to confirm or 
exclude hypoxia as a cause of the accident. The itemization of likely toxic causes will simplify and direct the work of the 
aviation toxicologist. These are the sort of matters which emphasize the need for frequent meetings of the heads of the 
investigation groups and the need for adequate exchange of information at such meetings. 


18.9.7 Special problems of the particular flight particularly concern those aspects of possible impairment of flight 
crew fitness and performance which are not demonstrable by autopsy. Errors and deficiency of performance may occur 
whether operations are as planned, whether unexpected conditions develop, or whether emergency situations arise. The 
cause of these errors and performance decrements may be found in: 


a) Errors of perception. These may be related to auditory, visual, tactile or postural stimuli; 
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b) Errors of judgment and interpretation. Misjudgment of distances, misinterpretation of instruments, 
confusion of instructions, sensory illusions, disorientation, lapse of memory, etc., fall into this category; 
and 


c) Errors of reaction. These particularly relate to timing and coordination of neuromuscular performance 
and technique as related to the movement of controls. 


18.9.8 Contributing causes of errors and performance deficiency may lie in such areas as: 
a) attitude and motivation; 
b) emotional effect; and 
c) perseverance. 


18.9.9 All these factors are likely to be exaggerated by fatigue which is a ubiquitous but elusive factor in aviation 
operations. It is in the evaluation of these potentiating factors that the Human Factors Group may be of invaluable 
assistance to the Investigator-in-Charge. 


18.9.10 The Human Factors Group must distinguish carefully between hypothesis and genuine evidence; 
whenever possible, factual evidence must be adduced before an accident can be ascribed to a psycho-physiological 
factor. For example, it may be suggested that the pilot was particularly irritable at the time of the flight; but a replay of the 
recordings of his in-flight transmissions may give far better evidence as to whether or not this effect was operative at the 
time of the accident. 


18.10 SUMMARY 


18.10.1 The composition of the Human Factors Group must be chosen on the basis of the type of accident and the 
evidence likely to be available from human sources. Specialists in aviation medicine will be of greatest value when there 
are many survivors but pathological assistance will be required whenever there are fatalities. 


18.10.2 Particularly in the event of a wholly fatal accident, the pathological evidence is an essential part of the 
technical investigation and the Investigator-in-Charge must ensure that important investigative information is not 
sacrificed to meet sociological and legal desires for rapid identification and disposal of bodies. To this end, the 
Investigator-in-Charge should, if possible, obtain the services of a pathologist familiar with aircraft accident investigation 
and who is capable of coordinating the two inter-dependent functions of investigation and identification. 


18.10.3 The prime object of the pathologist should be to obtain evidence as to the cause, sequence and effect of 
the accident through an examination of the operating crew, the cabin attendants and the passengers. Coincidentally with 
this investigation, evidence as to identification and of medico-legal significance will automatically emerge, particularly if 
each examination is enhanced by the coordinated efforts of the pathologist, police, odontologists, radiologists, etc. 


18.10.4 The pathological examination will be greatly assisted by adequate pre-planning particularly in relation to 
the recovery of bodies and the provision of whole body refrigeration. In the event that plans do not exist, the Investigator- 
in-Charge must ensure facilities for the pathologist to carry out the following minimal requirements based on 
investigative, medico-legal and sociological needs: 


a) identification and complete examination of the operating crew on the flight deck or in the cockpit; 


b) a full external examination of all fatal casualties; 
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c) identification of the cabin attendants and comparison with the passengers; 
d) minimal internal autopsy on all casualties to include: 
1) establishment of the cause of death; 
2) discovery of major disease likely to influence life expectancy; and 
3) assessment of deceleration injury to: 
i) cardiovascular system, liver and diaphragm; and 
ii) head, sternum, spine and pelvis; 
e) selection of blood specimens from all casualties for carboxyhaemoglobin studies; and 
f) collection of specimens of lung from all casualties for estimation of the mode of death. 
18.10.5 An experienced pathologist will interpret the findings with caution. For their part, the head of the Human 
Factors Group and the Investigator-in-Charge must ensure that the pathological findings are taken as part of the 
investigation as a whole and are fully correlated with evidence adduced within the Group and by other Groups. 


Experience has shown that this is facilitated and maximum advantage gained if the pathologist attends the periodic 
briefings by the Investigator-in-Charge. 


Chapter 19 


INVESTIGATION OF EXPLOSIVES SABOTAGE 


19.1 GENERAL 


19.1.1 According to ICAO statistics, between 1970 and 2007 23 aircraft have been destroyed in flight by acts of 
sabotage. This includes aircraft destroyed by the detonation of an explosive device within the aircraft. This figure does 
not include known hijack incidents or the shooting down of aircraft in military or para-military activities. Neither does it 
include unconfirmed cases nor aircraft missing in suspicious circumstances. 


19.1.2 Scientists collaborated with aviation investigation authorities to determine whether detonation of an 
explosive charge was involved in an aircraft that had crashed under mysterious circumstances. Considerable expertise 
has been accumulated in the method of searching debris and in scientific evidence deduced with the aid of various 
analytical techniques. The following is a review of the main techniques used. In particular, metallographic and scanning 
electron microscopic evidence is presented on several features associated with explosive damage. Although only 
described in brief, these features are discussed with respect to the strength of evidence. Forensic evidence is outlined in 
relation to the various non-metallic materials likely to be encountered and the methods of physical or chemical 
examination employed. Caution is stressed with respect to the interpretation of shredded fabrics as possibly indicating 
significant evidence of explosive events in aircraft in flight by comparison with other explosion experiences. Levels of 
explosive detection are indicated for the various chromatographic techniques available to the analyst. Major evidential 
value to be derived from radiography of both bodies and baggage for embedded fragments of metal is highlighted. 
Detonations of an explosive device within an aircraft are infrequent events. Therefore investigators investigating 
occurrences possibly involving such a device should get current expertise from explosive experts from the police or the 
military. 


19.2 INVESTIGATOR’S EVIDENCE 


Material evidence at the scene 


19.2.1 The technical investigation by specialists at the site of the accident is of the utmost importance. It is under 
these circumstances that the knowledge and experience of the investigator is invaluable, particularly if explosive 
sabotage is suspected, for it is at this stage that maximum material evidence is to be isolated and retained for 
subsequent laboratory examination. 


19.2.2 When faced with more than 50 tons of disintegrated and possibly burnt wreckage, probably spread over 
many miles of desolate countryside, or salvaged piecemeal as small amounts of flotsam, the evidence will be anything 
but clear during the early stages of investigation as to the probable cause of the accident. The investigator must proceed 
carefully, with an open mind, before reaching a conclusion that reports of an ‘explosion’ having been witnessed or heard 
have no connection with a major malfunction of the aircraft systems or its power plants. For instance, the disintegration 
of a high speed turbine disc can produce a loud explosion-like noise. 
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19.2.3 Shrapnel-type pieces of metal can sometimes penetrate the wings or fuselage, possibly causing a fire the 
result of which in total might be suggestive of an explosion having occurred. To the experienced eye, detailed 
examination will show considerable differences between this type of damage and that produced by the detonation of an 
explosive substance. (See Figure II|-19-1.) 


19.2.4 The structural break-up of an aircraft in high speed flight caused by overstressing or fatigue will often be 
reported by witnesses as an “explosion” and the noise, smoke or fuel vapour will tend to convince them. 


19.2.5 A lightning strike can also, on rare occasions, create local explosive-type damage, particularly if the 
aircraft's structural electrical bonding is faulty. Normally such lightning strikes will not cause extensive or catastrophic 
damage but fire and low pressure explosion of fuel tanks is a possibility if low flash point fuel is in use and vented near 
the wing tips, a favorite place for lightning strikes. Supporting evidence of electrical discharge, entry or exit, on the 
aircraft structure should normally be apparent at the aircraft extremities. 


19.2.6 If the wreckage is available for inspection, the material evidence of a deliberately planted and detonated 
explosive device will reveal distinctive characteristics or signatures. (See Figure II|-19-2.) 





Figure Ill-19-1. Fragment penetration in Pan Am Flight 103 
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Figure Ill-19-2. Fuselage reconstruction of Pan Am Flight 103 
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19.2.7 Detonation of a modern high explosive can create particle velocities in excess, at least initially, of 
7 x 10° m/s which give rise, if sufficiently large, to deep penetrations of structural components and even when very small 
can deeply penetrate soft materials such as seat cushions and human bodies. No failure of any system or power plant in 
the aircraft can accelerate small particles to such velocities. Scorching, blackening, pitting, i.e. small craters in metal 
surfaces, or high velocity cutting of soft materials may all be present and are indicative of very unusual circumstances. 


19.2.8 The blast itself, which may be in an area free from any operating mechanism or pressurized system which 
could possibly cause such a blast, is obviously a pointer in itself. Trajectory plotting by rods, string or wire can 
sometimes assist in the location of the origin of detonation. Quite often, by sustained and diligent search for small details, 
pieces of a detonator or timing device may be found jammed into a piece of structure, furnishing, suitcase, freight or a 
body. Such evidence, however small, is vital and may prove conclusive. Inspection of bodies, clothing and suitcases is 
important and any feature which suggests blast, such as shredding, heat or melted plastic fibers is important and should 
be retained for examination. 


19.2.9 Such evidence, when subjected to the latest techniques in the chemical laboratory, may provide a clue to 
the type of explosive used. Any material, metallic or otherwise, which appears unusual and unidentified with any part of 
the aircraft should be preserved for further investigation, for timing devices are also infinite in design and appearance. 
Maximum security of all specimens must be exercised at all times. 


Flight data recorder (FDR) 


19.2.10 The majority of commercial public transport aircraft now carry flight data and cockpit voice recorders. The 
data recorder is designed and installed such that it is survivable even against severe impact, fire and liquids. 


19.2.11 The FDR will reveal to subsequent expert examination the immediate circumstances prior to the disaster 
which may help to eliminate a number of possible causes. It will not indicate specifically that an explosion aboard the 
aircraft had occurred. For the information stored in the FDR to be of value, the chief accident investigator will make 
recovery of the FDR one of the primary objectives and for its recorded data to be made available as soon as possible. 


19.2.12 Reproduction of an actual FDR record with all its simultaneous readings is not practicable within the 
confines of a single page for a number of reasons. However, extracts of the critical traces from the Cathay Pacific 
Airways Convair 880 crash of 15 June 1972 are reproduced in Figure III-19-3 to illustrate the spikes recorded (ringed), 
and subsequently considered to be indicative of a detonation on board this aircraft, for the ‘g’ and ‘speed’ changes. The 
traces for heading, pitch and altitude also show similar sudden changes of attitude. 


19.2.13 The abrupt cessation of the data recorder, sometimes accompanied by a short and wild diversion of the 
traces, is nearly always due to the cutting off of power by rupturing of the electrical supply cables. Such a rupture may 
be caused by airframe structural failure or the detonation of an explosive device. A sharp spike on the ‘g’ acceleration 
trace, positive or negative to the normal, has been observed at the moment of cut-off on occasions when an internal 
explosion has been established. This spike is very different in character and timing from that associated with flight 
turbulence and is probably caused by very rapid vibration of the ‘g’ transducer which is normally mounted on the 
airframe structure close to the centre of gravity of the aircraft (Figure IIl-19-3). The position of this abnormal spike along 
the recording will give the precise time of the occurrence and, with other parameters such as height, speed, heading, 
pitch, etc., will be of great assistance to the investigators in the process of assessing other aspects. For security 
considerations, some aircraft also have cabin video recording devices in order to provide evidence of unruly passengers. 
These recordings may also provide evidence of explosive damage or other systems failure. 
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Figure Ill-19-3. Air speed and acceleration traces from the Convair 880 aircraft 
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Cockpit voice recorder (CVR) 


19.2.14 On rare occasions the CVR operating from a number of microphones on the flight deck has given a clue to 
the events that occurred immediately before the incident, for example, remarks by the crew or a millisecond noise 
swamping the recording equipment as a result of the shock-wave from detonation of an explosives device. Area 
microphones may also pick up flight deck aural warnings such as horns, bells, etc. which can be identified as associated 
with sudden loss of cabin pressure, engine fire and other failures. 


19.2.15 Smoke and toxic fumes from fires can prove disastrous and recorded voices of the crew on such occasions 
can provide important clues as to the ultimate cause of final loss of control. When preliminary investigation supports the 
opinion that explosives sabotage was involved, the read-out and analysis of both data and CVR recorders must always 
be undertaken by experts, preferably those experienced in examining recorder traces from previous cases of explosives 
sabotage in aircraft. 


Surface characteristics of interest 


19.2.16 Fractures of metal caused by an explosive event are normally different in character to those caused by 
overstressing or crash impact forces. Shattering of metal into very small and numerous fragments and minute deep 
penetration of a metal surface are not characteristics usually found in aircraft accident wreckage. The size and 
characteristics of these particles often accompanied by rolled edges, surface spalling, pitting or evidence of heat is of 
importance, whereas a fractured surface may not in itself provide conclusive evidence of an explosion. All suspicious 
particles should be preserved and identified for subsequent laboratory examination. 


19.2.17 If a violent explosion occurs within an aircraft in flight then the mode of break-up of the aircraft itself and its 
sequence of failure will usually be very complicated and quite without logic from a normal aerodynamic overstressing 
standpoint. Before any thoughts of explosive sabotage are propounded the structure of the aircraft and its engines must, 
of course, be eliminated as the possible cause of any damage to the structural parts and fabrics. 


Autopsy and radiographic examination 


19.2.18 Once the investigator has obtained material evidence in support of an explosion having taken place, every 
effort must be made immediately to have as many of the dead and injured, as are available, X-rayed and submitted for 
limited pathology for the extraction of any buried particles. Close collaboration with the medical team, pathologists and/or 
coroner must be maintained from the start and the purpose for this close liaison explained. This also often involves 
cooperation with legal and police authorities. Diplomacy and tact is very necessary at this stage. It is desirable, if 
possible, for the pathologist to assist or be present during radiographic examination of the victims. Photography, 
preferably in colour, is also very helpful to later detailed study. 


19.2.19 Pathological examination for blast effect on the eardrums, lung damage due to overpressure, unusual or 
gross traumatic injuries not normally associated with an aircraft crash impact, examination of skin tissue for hot 
penetration, flash burns, ‘peppering’, etc. can be of great assistance. 


19.2.20 Any extracted particles, however small, should be carefully preserved in the unwashed condition, for future 
laboratory examination. It is perhaps not readily appreciated that liquids used to prevent putrefaction of metal items 
extracted from bodies, particularly the formaldehyde based preservative, can cause excessive surface corrosion during 
storage and transportation, with consequent loss of possibly valuable topographical features. Surgical spirit would be a 
more acceptable medium for this purpose. Care should also be taken to avoid undue handling of particles with forceps 
and other hard materials which could also obliterate surface markings. 
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19.2.21 It may well be that no explosive evidence is produced during the autopsy examination due to the location 
of the explosive device and the shielding effect of the aircraft structure. However, the importance of X-ray and autopsy in 
the early stages cannot be overemphasized when investigating a suspected explosive sabotage incident. The evidence 
obtained from a body, however small, when subjected to experienced forensic laboratory, metallurgical and chemical 
analysis, can be conclusive. 


Identification of items 


19.2.22 When collecting items of potential scientific interest it must be remembered that similar items found in 
close proximity, but which do not exhibit these characteristics, should be included as control items for scientific 
comparison. This applies particularly to fabrics, wires, items of luggage and clothing. Should it be impossible for a 
forensic scientist to be available at the scene to help identify those items of explosive interest, or to take solvent 
swabbings of interesting surfaces for traces of undecomposed explosives, the investigating officer should include 
controls of cotton-wool, solvent and all other items so used, properly labelled and sealed in nylon bags. 


19.2.23 It may happen that criminal proceedings are later initiated, based on scientific evidence of explosives 
resulting from laboratory examination, and that evidence of continuity must be established in a Court of Law. To avoid 
difficulties at a later stage, investigating officers should be most particular about records of origin, custody and handing 
over of items for forensic examination and to ensure that adequate documentation and signatures are obtained at all 
stages of transfer. 


19.3 METALLURGICAL EVIDENCE 


General 


19.3.1 Explosives function by chemically decomposing at a rate much faster than the speed of sound and are 
characterized by a reaction front which proceeds gas at a very high temperature and pressure. This extremely high rate 
process, known as detonation, liberates large amounts of energy associated with the reaction front. A typical detonation 
rate for military high explosives is 7 x 10° m/s and a pressure of 3 x 10° atmospheres both of which are large. In 
comparison to other fast processes which could arise from aircraft accidents, for example a fuel/air explosion where 
typical over-pressures are 2 x 10' atmospheres but exceptionally could be as high as 2 x 10° atmospheres, or ground 
impact velocities in the range of 50-200 m/s with a probable supersonic maximum of about 500 m/s. These values must 
also be compared with the maximum peripheral velocity of a turbine blade, should it break up under take-off load, of 
about 450 m/s for a Boeing 747 jet low pressure fan. Thus it can be seen that detonation of high explosives produces 
most violent and rapid processes which result in a number of signatures imparted to metals which can be positively 
identified by the appropriate examination. 


19.3.2 When a detonation occurs, one or more of the following features may be observed: 
a) the creation of many small fragments from the bomb-casing; 
b) deformation at high rates of strain of materials adjacent to the detonation source; 
c) the formation of distinctive surface effects such as pitting and/or gas washing; and 


d) the formation of characteristic fracture patterns. 
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Fragments 


19.3.3 An explosive device need not be contained within a rigid metallic container in order to be effective but, 
should this be so then the expanding hot gases rupture the casing projecting the fragments outwards as it were from a 
point source. In general, the higher the velocity of detonation the smaller will be the fragments formed. These fragments 
will receive little further distortion if they are decelerated relatively slowly, for example, by catchment in soft cushions, 
human bodies or suitcases. Indeed, in past investigations all three sources have proved to be valuable sources of 
information (Bedford, 1976 and Clancey, 1968). Total loss of detonation characteristic is rarely caused by subsequent 
impact with wood or plastics laminated surfaces or even metal. 


19.3.4 The fragment, when found, is commonly located at the bottom of a charred cavity, particularly with 
polyurethane foam from cushion seats, and is an indication of the high velocity of impact. The fragments are often hot 
enough on impact to melt the surrounding plastics material, as evidenced in Figure IIl-19-4, found during the Comet 
investigation. 


Surface characteristics of fragments 


19.3.5 A variety of features have been observed on fragments from both laboratory controlled explosions and 
from items recovered from aircraft accidents. A very useful compilation of surface characteristics is given in a publication 
(Tardiff and Sterling, 1967) which illustrates some of a number of various surface characteristics which have been 
reproduced on mild steel and aluminium in contact with nitroglycerine-based commercial blasting explosive, or military 
plastic (RDX) explosive. Micro features which have been observed are gas-wash, surface pitting and rolled edges, all of 
which are more commonly encountered. 


Gas-wash 


19.3.6 The effect is one of melting and erosion of the metal surface by hot detonation gases, most frequently 
observed on the inner surfaces of gun barrels after excessive firing, hence it is well documented and understood. 
Figure IIl-19-5 shows the surface of a fragment from the Comet flotsam which exhibits this feature and a similar effect 
after detonation of RDX contained in an aluminium tube. 


Surface pitting 


19.3.7 This feature, illustrated in Figure IIl-19-6, can be observed on fragment surfaces closely associated with 
the point of detonation. It has also been observed on fragments from the Comet and from the Middle East Airlines 
Boeing 720B accident (Higgs and others, 1976). In this latter case RDX was confirmed as present on some of the 
contents of the baggage hold. It is thought that the pits are caused by the impingement of high velocity particles of 
partially combusted explosive and/or fused extraneous matter encountered between the explosive charge and the 
‘witness’ material. A commercial nitroglycerine-based blasting explosive and RDX respectively were detonated in 
aluminium tubes under controlled conditions and it was observed that only the fragments from the RDX showed pitting. 
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Figure Ill-19-4. Comet seat fragment with occluded polyurethane foam 





Figure Ill-19-5. (Left) Gas-wash effect on a fragment from the Comet; 
(Right) Gas-wash on aluminum from detonation of RDX 
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Figure Ill-19-6. Surface pitting on a fragment from the Comet aircraft 


Rolled edges 


19.3.8 This is a fracture feature associated with the formation of the fragment shown in Figure Ill-19-7 derived 
from the Cubana DC8 accident (Higgs and others, 1977) and should be compared with similar features produced 
experimentally as shown from the detonation of a 2-oz charge of commercial blasting explosive strapped to a 1.5 volt 
zinc-cased dry cell. This feature is known only to result from detonative processes and is considered to be the result of 
the venting of hot gases partially melting and rolling over the sharp fractured edge in a direction away from the venting 
gases. Such features are completely smooth and devoid of fracture marking or other fissures. 


19.3.9 It is difficult to imagine how these fragments could be produced other than through the action of explosives. 
The particles exhibit evidence of intense heating, chemical deposits, and high strain rate deformation. Although 
conventional machining will produce particles of the same general shape, their examination under the electron 
microscope reveals entirely different surface characteristics, the deformation being of parallel ridges caused by the 
action of the cutting tool, giving an overall effect of a ploughed field. Laboratory experiments in which small fragments 
were produced by the action of explosives give excellent agreement with actual forensic evidence. 


19.3.10 Thus it can be seen that small particles of metal which exhibit gas-wash, pitting and rolled edges can only 
be accounted for in terms of an explosion and there is excellent agreement between actual forensic evidence and 
laboratory experiment. 
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Figure Ill-19-7. (Left) Rolled edge effect on a fragment from the Comet aircraft; 
(Right) Controlled detonation of NG-based explosive in association with a zinc-based 1.5 volt dry cell 


19.4 STRUCTURE AND COMPOSITION OF FRAGMENTS 


Twinning 


19.4.1 As well as the surface effects produced by explosives there are deformation mechanisms, which are 
peculiar to high rates of strain at normal temperatures. At normal rates of strain metals deform by the usual mechanisms 
associated with dislocation movement. However because this process is thermally activated at high rates of strain there 
is insufficient time for this process to occur and in some metals deformation takes place by twinning as seen in 
Figure IlI-19-8. 


19.4.2 In copper and iron this feature is well documented and is regarded as proof positive of an explosion. Such 
features were located in fragments recovered from the 1967 Comet and the 1974 TWA Boeing 707 disasters. 


19.4.3 Occasionally it is possible to detect these features in components which were adjacent to the centre of the 
explosion but not part of the bomb casing (Cox, 1974). However the detection of twins by optical microscopy in this 
instance requires much persistence because of their infrequent occurrence. 


Re-crystallization 


19.4.4 Sometimes the deformation sustained by a fragment is so large that the particle heats sufficiently for re- 
crystallization of the worked structure to occur. Further, as the particles are generally small and consequently cooling is 
fast the resultant grain size is abnormally small, typically 1-3, shown in Figure IIl-19-9. Commercial mild steels usually 
have a grain size of about 50u upwards. Very fine grain sizes have been observed in controlled experiments and actual 
investigations (Higgs and others, 1976). However, it is possible to produce these grain sizes by either special thermo- 
mechanical treatment or, more commonly, by grain growth inhibitors. For these reasons fine grain sizes can only be 
regarded as an indication and not proof positive of heating as an outcome of explosives involvement. 
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Figure Ill-19-9. Example of re-crystallization in steel alloy fragment 
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Composition 


19.4.5 The finding of fragments of material different to that in use in aircraft structure is further important evidence 
of the explosion of introduced objects into the aircraft. Low alloy steel fragments have been discovered in forensic 
investigations. Sometimes checking of all the material in use in the aircraft is necessary to confirm that the explosive 
was in a container whose material was foreign to any in use in that particular aircraft. 


Air-frame damage — Adiabatic shear 


19.4.6 Adiabatic shear occurs when the heat generated by plastic deformation has insufficient time to dissipate. 
This results in microstructural modifications which have been observed in steel, shown in Figure III-19-10, (Bedford and 
others, 1976) and in titanium, copper and aluminium alloys. The necessary conditions for adiabatic shear are that the 
deformation is restricted to a localized region, that large strains occur and that the deformation rate be high. Such 
conditions are encountered in projectile/target impact and explosive fragmentation. 


19.4.7 It has been shown, however, (Wingrove, 1973) that under favourable conditions adiabatic shear can occur 
at velocities of 160 m/s although no lower limit has yet been determined. Therefore although the detection of adiabatic 
shear zones is a most useful indicator, it cannot be regarded as proof positive. 


Impact craters 


19.4.8 An excellent example of surface pitting was found in structural components connected with the crash of the 
Cathay Pacific Airways Convair 880 VR-HFZ on 15 June 1972 (Lidstone, 1972). Figure IIl-19-11 shows a typical 
example of several such craters each of which were totally blackened, suggestive of involvement in a fire subsequent to 
the formation of the craters. 


19.4.9 Impact with the airframe by small bomb case fragments can be of such violence as to cause a splatter 
cavity as illustrated in Figure IIll-19-12. It can be calculated that the fragment must have been traveling at speeds in 
excess of 103 m/s for the particle to have melted. The presence of this feature is therefore good evidence that a 
detonation took place. 


19.5 CHEMISTRY AND MATERIALS ASSESSMENT 


Role of the forensic scientist 


19.5.1 The normal role of a forensic scientist, concerned with evaluating bomb debris, is to isolate from amongst 
an overwhelming mass of general debris such items as remain after the detonation of a bomb or improvised explosive 
device (IED), as such interest lies in identifying fragments of battery, timing mechanism, wires, tapes and the charge 
container. Generally there is other substantiating evidence that an explosion had occurred, thus forensic emphasis is 
placed on identification of the components of the device and on solvent swabbings from selected items as a preliminary 
to chemical identification of the explosive used. 


19.5.2 A further aspect of forensic work on explosives devices is that English Courts of Law do not demand 
detailed proof of explosive association of any items raised as exhibits as is the case in other countries. It is necessary 
only for the expert giving evidence to state that in his or her opinion, based on long years of experience, that the nature 
of the damage is consistent with that to be found from controlled explosions involving similar explosives and materials. 
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Figure Ill-19-10. Adiabatic shear in mild steel 





Figure IIl-19-11. Pitting resulting from high velocity impact 
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Figure Ill-19-12. Pitting on aluminum wing metal from Convair 880 VR-HFZ 


19.5.3 The problem facing the forensic scientist dealing with aircraft wreckage is quite different in basic approach 
since one cannot assume that an explosion, that is the detonation of an explosive charge, had taken place despite 
hearsay evidence to this effect. The scientist in these cases has to seek signs which resemble known land-based 
explosion damage and to use these as a starting point for the investigation, at all times keeping a strictly open mind as 
to alternative explanations which might account for the evidence being studied. Such was the forensic beginning of the 
enquiry into the Comet G-ARCO accident. 


19.5.4 In addition to the features already described as of metallurgical significance in association with a 
detonative event, it is possible to generalize and suggest likely areas of damage to non-metallic materials. For example, 
a) highly shredded and teased woven fabrics, b) plastics panels with small penetration holes, c) unusual damage and 
discoloration of curtains or seating materials and d) severely damaged suitcases, etc. in close proximity to many others 
which appear relatively undamaged. Each of the above features may not readily indicate the characteristic evidence of 
an explosive event but, when viewed at high magnification, much valuable information may be revealed, examples of 
which are highlighted in the following paragraphs. 


Radiophotography 


19.5.5 Darkened striations accompanied by irregular tears, which seemed to radiate fanwise from a point, on one 
of the seat squabs seen by the investigator was recognized as closely resembling damage to a similar polyurethane seat 
cushion seen at RARDE, Woolwich. This latter item was part of a case being studied in which explosive had been used 
by criminals to break open a safe and the cushion had been used to muffle the sound of the explosion. 


19.5.6 The Comet story is sufficiently well known not to need recounting in detail. A brief but useful review of the 
salient features of this investigation was published in The New Scientist (Clancey, 1968b). The Comet investigation was 
the first major investigation of this kind and in three important respects was typical of several investigated since. 
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19.5.7 Firstly, it highlighted the value of X-ray photographic facilities being applied both to items and bodies for 
the location of minute fragments of buried material, particularly when there is evidence of penetration of either. Secondly, 
it revealed to diligent search that a mass of information can often be derived from a minimum of debris and that plastics 
materials were equally effective as metals in showing characteristic damage. Thirdly, use of the scanning electron 
microscope was used for examining and analyzing fragments. 


Fiber analysis 


19.5.8 A fragment of zinc extracted from the Comet seat squab was seen to be associated with a tuft of fibrous 
material which consists of 40 to 80 fibers of maximum diameter 0.01 mm wound loosely in a clockwise manner. The 
fibers were tape-like and hollow and possessed convolutions typical of cotton (Todd and others, 1968). Figure III-19-13 
shows these fibers in comparison with similar white fibers taken from one of the Comet seat covers. Chemical tests 
confirmed the fibers to be cotton and polished sections of fiber mounted in epoxy resin showed the typical hollow kidney- 
shaped cross-section of cotton. 





Figure IIl-19-13. Comparison of Comet fragment fibres (top) with seat fibres (bottom) 
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X-Ray diffraction analysis 


19.5.9 An aircraft investigation which illustrated the value of molecular species identification by use of X-ray 
diffraction (XRD) analysis was that associated with debris from an Aer Lingua Viscount E1-AOM lost in the Irish Sea on 
24 March 1968 (Higgs, 1970). Investigation of the original flotsam by Clancey showed no evidence of explosives 
involvement. Some 18 months later two blinds were dredged up and sent to one of the authors (DGH) for examination. 
One of these blinds, shown in Figure Ill-19-14, had a large area of blackening which was thought to be evidence of a fire 
having occurred aboard the aircraft before its crash into the sea. 


19.5.10 The cabin side of the blind was seen to have a regular raised pattern superimposed on a silvery-colored 
specular substance giving an overall lustrous appearance. Solvent removal of the outermost polymer layer released the 
underlying specular substance which was subsequently found by XRD analysis to be a form of basic lead carbonate 
known as PLUMBONACRITE. Further, the darkened areas were also seen to have a lower content of this substance 
compared with the unblackened material and a new XRD pattern for lead sulphide. 


19.5.11 Experiment showed that immersion of the uncoloured blind material in water containing hydrogen sulphide 
gas slowly converted the white basic lead carbonate into the darker lead sulphide. 


19.5.12 Examination of the blind for oil contamination was made difficult by the presence of an oil-modified lacquer 
as its projective outer layer. Comparison of stained with unstained areas of blind showed no difference that could be 
attributed to the presence of oil. Nevertheless, it was considered that the most probable mechanism by which the blind 
was darkened was the entrapment of a quantity of sulphated or sulphonated oil within the folds of the blind, which was 
found in the rolled up position, which had become biologically degraded during the long sea immersion and that the 
excess oil had long since been washed out. 





Figure Ill-19-14. Damaged and blackened Aer Lingus Viscount blind 
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Microscopic examination 


19.5.13 Several excellent examples can be cited (Ref a. Higgs 1974, Hayes 1976, Higgs 1976 and Todd 1968) to 
support the use of a simple stereomicroscope in order to highlight features not readily apparent to the naked eye. 
Perhaps the most spectacular results were derived from seemingly unfavourable circumstances connected with the 
flotsam from the TWA Boeing 707-3311, N8734 lost over the lonian Sea (Higgs 1974). 


19.5.14 Of particular interest amongst the limited flotsam recovered was a red Samsonite suitcase which appeared 
to have suffered only trivial damage. On close inspection it was observed that several very small penetrations and 
lacerations of the outer red plastics covering were present. Corresponding with these were blackened and once-melted 
penetrations of the high density polyethylene ribbed inner case structure. Typical of this feature is that shown in Figure 
IIl-19-15. The damaged and blackened areas were viewed under a low power stereomicroscope and found to present a 
mass of shredded, blackened and softened plastics in which were entrained numerous coloured fibers having no 
obvious connection with the case fabrics. Careful probing with specially pointed tweezers revealed several minute 
fragments of metal, all much smaller than a pin’s head. Eventually this probing isolated fragments of metal found 
subsequently to be aluminium, copper, brass, zinc and iron. Each fragment was mounted on a glass microscope slide 
for immediate safe examination. Subsequent scanning electron probe microanalysis confirmed the elemental 
composition of these fragments as well as revealing highly distorted surface characteristics. Manganese dioxide traces 
were also confirmed to be present in some of the blackened areas of this case, thus suggesting that an electric cell had 
been in very close proximity to the detonative source. Typical fragments are illustrated in Figure III-19-16. 


Damage to fabrics 


19.5.15 The Boeing 720B debris yielded evidence of damage to fibrous materials not previously encountered. A 
green half-suitcase was seen to be not greatly damaged but which had a small area of external tearing near the top 
edge. Close examination showed that embedded in the tear was a mass of partly fused red fibrous material. The 
substrate to this green case was a coarsely woven yellow reinforcing fabric which remained undamaged at the point 
opposite the tear in the green plastics outer covering. However, the impacted red mass had been forced between the 
warp and weft of the yellow fabric and was strongly adherent to it. Such damage could not possibly result from 
mechanical impact and must indicate that the red fibrous mass was impacted onto the green suitcase whilst still hot and 
with extremely high velocity. 


19.5.16 A white Clubmaster polyester shirt also yielded evidence of bombardment by similar fused red fibrous 
material at two locations, namely, the collar area and on the corner of the right hand sleeve button-hole. In both 
instances the red fibers were forced through the undamaged shirt material to reappear on the opposite face of the 
polyester weave. Bonding had taken place between the polyester and the red fibrous mass such that they could not be 
separated by strenuous tugging with the aid of forceps. 


19.5.17 The finding of RDX and nitroglycerine together with the above feature and many others not recounted here 
left no doubt whatsoever that an explosive charge had been detonated aboard this aircraft in close proximity to a 
quantity of clothing and had given rise to this characteristic damage. 
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Figure Ill-19-16. (Left) Fragment of aluminium; (Right) Fragment of copper 
from Boeing 707-331B Samsonite case 
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Shredded and teased fabrics 


19.5.18 Disruption of woven fabrics in close involvement with an explosion are often seen to be teased to the 
extent that long streamers of warp and weft threads are exposed. Two other aerial circumstances, however, are known 
to produce the same effect once the weave is sufficiently weakened to produce a tear. For example, it is a fairly common 
sight to witness old flags, which are constantly whipped by strong winds, showing such streamers at their downwind 
extremities. 


19.5.19 Similarly, it was commonly found in older aircraft which utilized dope-reinforced canvas coverings that a 
tear sustained whilst airborne would shed its lacquer and become teased to some considerable extent whereas a tear 
during impact would be clean and devoid of teasing. Clearly in modern aircraft a fabric so found after a crash could 
mean that air turbulence, following structural damage whilst in flight, could be responsible for the degree of damage 
observed. The cause of the initial structural break-up of the aircraft is quite immaterial in this instance. It certainly cannot 
be inferred that such damage, because it resembles that to be found in a landbased explosion, necessarily implies that 
an explosion of high energy has taken place during flight. 


19.5.20 The most valuable evidence from damaged fabrics and woven materials can often only be seen when 
viewed under low power microscopy. Typical examples of this were encountered in fabric debris isolated from flotsam 
connected with the loss of the Cabana DC8 CUT 1201 off Barbados on 6 October 1976 (Higgs and others, 1977). Many 
minute and not so small fragments of a gauze-like material were observed entrapped in several suitcases which was 
later identified as a special weave of nylon 6:6 bonded with a polyisobutylene polymer containing antimony oxide used 
as the fire depressant. It was also discovered that the polymer coating dissolved readily in kerosene, which explains why 
the characteristic green colored polymer coating was absent from the flotsam fragments. Although most of this nylon 
showed only mechanically torn ends to the fibers, some were, however, fused and globularized in a manner, shown in 
Figures III-19-17 and IIl-19-18, which could not be reproduced by the most transient passage of the cloth through a 
Bunsen flame. For example, such heating always produced severe globularized ends which showed internal gas 
evolution (formation of bubbles due to decomposition whilst molten) and/or darkening to produce various shades varying 
from yellow to brown. In contrast, experiments involving detonation of small charges of commercial blasting explosive 
showed that over an optimum range the characteristics observed on the Cubana items could be reproduced 
(See Figure III-19-19) on a control sample of the nylon provided by the Canadian owners of this aircraft. 


Chemical identifications of explosive 


19.5.21 No evidence of explosive traces were found on the Comet and Convair fragments or, as previously stated, 
on the blinds from the Aer Lingus Viscount. It is considered that there may have been some possibility of detection had 
the sensitive detection methods now used been available at that time. In all three latest investigations (Higgs 1974, 
Hayes 1976 and Higgs 1977) thin layer chromatographic tests showed the presence of traces of explosive, that for the 
TWA Boeing 707 being very faint whilst the presence of RDX and NG on the Boeing 720B and of NG on the Cubana 
DC8 were in ample supply to be confirmed beyond doubt by different procedures. 


19.5.22 The DC8 situation offers interesting possibilities for future occasions in that despite at least 16 hours 
immersion in sea water, and at least 2- to 3-weeks’ delay before various items could be tested, strong reactions were 
obtained for nitroglycerine after solvent swabbing of the surfaces of several plastics-covered suitcases recovered 
amongst the flotsam. 
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Figure Ill-19-17. (Left) Nylon 66 from DC-8 aircraft showing fused ends; (Right) Enlarged view 





Figure Ill-19-18. _Globularized ends of fibers showing absence of blackening and gas bubbles 
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Figure Ill-19-19. (Left) Controlled-explosion damage to Canadian Nylon 66 sample; 
(Right) Enlarged view 


19.5.23 All items smelt strongly of kerosene when received in these laboratories. Kerosene is also strongly 
absorbed into some plastics, particularly the form of polyvinyl-chloride (PVC) which formed the outer covering of these 
cases. This fact suggested that the initial flash deposits of explosive may have been washed into the plastics by solvent 
action of the kerosene and thus preserved against solution in sea water as would be expected in the case of 
nitroglycerine. Such was proved to be so when sections of PVC cut from the case were refluxed in solvent. Unfortunately 
choice of solvent is limited if it is not also to dissolve the polymer and those most suitable for explosives residues also 
extract kerosene and the phthalate plasticizers. Consequently subsequent clean-up procedure to separate the explosive 
in a form amenable to chromatographic analysis was very tedious but it did prove the point that considerably more 
explosive was contained within the bulk of the polymer than appeared on the surface. 


Infrared spectrophotometry 


19.5.24 It is seldom that sufficient explosive traces are located on debris to enable a positive infrared spectrometric 
identification to be made, even allowing for the use of a miniature disc sample in conjunction with a microbeam 
condenser. Such was the case, however, with debris from the Middle East Airline Boeing 720B OD—AFT investigation 
(Hayes and others 1976) which crashed on the Saudi Arabian desert on 1 January 1976. 


19.5.25 One of the two half suitcases, a red tartan case, was seen to be liberally dusted with a white powder; this 
was eliminated from our enquiries when infrared analysis showed the substance to be an anionic sulphonated alkyl 
detergent containing a condensed phosphate addition and was confirmed as having been part of the cargo manifest. 


19.5.26 Solvent extraction of the surfaces of this red half case yielded sufficient material to give a good spectrum 
using the standard 13 mm potassium bromide disc technique. Figure III-19-20 shows the spectra so obtained in 
comparison with that of a pure sample of the military explosive RDX (cyclotrimethylene trinitramine, also known as 
cyclonite and hexamine). 


Part Ill. Investigation 
Chapter 19. Investigation of Explosives Sabotage Ill-19-23 





WAVENUMBER (ew) 
4060 3600-3200 280024002000 s«800—s«gOSsitdSsi«éd200-—i«=it0s8s«G SO 


100-4 


OM MeL SIs 





wavemumara (cart 
4000 3600 a0 2800 2400-2000 1800600400 2001000 200 


N I 


| | Ts | | 
| el TAN NH fll 

Sy TRAN | UP TEIE 
Hl SEU UAE 


Figure Ill-19-20. Infrared absorption spectrum of RDX isolated from the red tartan suitcase 
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Detection procedures 


19.5.27 Both thin-layer chromatography and gas-liquid chromatography are used, the latter in conjunction with 
electron capture detectors, to yield maximum sensitivity of detection and minimum interference from non-electron 
capturing impurities. 


19.5.28 Thin-layer chromatography using toluene as eluant followed by sodium hydroxide hydrolysis at 105°C and 
visualized with a modified Griess reagent is preferred as the best separation system for a range of explosives; it does 
not, however, separate NG and PETN (pentaerythritol tetranitrate). A separation of these two explosives is achieved ina 
mixture of ethyl acetate and petroleum ether as eluant which does not, however, separate RDX and HMX 
(cyclotetramethylene tetranitramine). A third eluant based on chloroform and methanol effectively separates RDX and 
HMX but not NG and PETN. Levels of sensibility for NG, RDX and PETN are respectively 2, 5 and 50 x 10°g per spot 
for a system optimised for the detection of nitroglycerine. Lower levels of detection are attainable for the other explosives 
under appropriate conditions. 


19.5.29 Gas-liquid chromatography is employed mainly for nitroglycerine, mono- and dinitrobenzenes and the 
corresponding nitrotoluene isomers rather than for the long retention timed military explosives. The level of detection 
available for NG is 2 x 10°” g. 
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19.6 MACH STEM SHOCK WAVE EFFECTS 


Introduction 


19.6.1 An explosive detonation within a fuselage, in reasonably close proximity to the skin, will produce a high 
intensity shock wave which will propagate outwards from the centre of detonation. On reaching the inner surface of the 
fuselage skin, energy will partially be absorbed in shattering, deforming and accelerating the skin and stringer material in 
its path. Much of the remaining energy will be transmitted, as a shock wave, through the skin and into the atmosphere 
but a significant amount of energy will be returned as a reflected shock wave, which will travel back into the fuselage 
interior where it will interact with the incident shock to produce Mach stem shocks: re-combination shock waves which 
can have pressures and velocities of propagation greater than the incident shock. 


19.6.2 The Mach stem phenomenon is significant for two reasons. Firstly, it gives rise (for relatively small charge 
sizes) to a geometric limitation on the area of skin material which the incident shock wave can shatter. This geometric 
limitation occurs irrespective of charge size (within the range of charge sizes considered realistic for the Flight PA103 
scenario), and thus provides a means of calculating the standoff distance of the explosive charge from the fuselage skin. 


19.6.3 Secondly, the Mach stem may have been a significant factor in transmitting explosive energy through the 
fuselage cavities, producing damage at a number of separate sites remote from the source of the explosion. 


Mach stem shock wave formation 


19.6.4 A Mach stem shock is formed by the interaction between the incident and reflected shock waves, resulting 
in a coalescing of the two waves to produce a new, single, shock wave. If an explosive charge is detonated in a free field 
at some standoff distance from a reflective surface, then the incident shock wave expands spherically until the wave 
front contacts the reflective surface, when that element of the wave surface will be reflected back (Figure IIl-19-21). The 
local angle between the spherical wave front and the reflecting surface is zero at the point where the reflecting surface 
intersects the normal axis, resulting in wave reflection directly back towards the source and maximum reflected 
overpressure at the reflective surface. The angle between the wave front and the reflecting surface at other locations 
increases with distance from the normal axis, producing a corresponding increase in the oblique angle of reflection of the 
wave element, with a corresponding reduction in the reflected overpressure. 


19.6.5 (To a first order of approximation, explosive shock waves can be considered to follow similar reflection and 
refraction paths to light waves, ref: "Geometric Shock Initiation of Pyrotechnics and Explosives", R Weinheimer, 
McDonnell Douglas Aerospace Co.) Beyond some critical (conical) angle about the normal axis, typically around 40 
degrees, the reflected and incident waves coalesce to form Mach stem shock waves which, effectively, bisect the angle 
between the incident and reflected waves, and thus travel approximately at right angles to the normal axis, i.e. parallel 
with the reflective surface (Detail “A”, Figure IIl-19-21). 


Estimation of charge standoff distance from the fuselage skin 


19.6.6 Within the constraint of the likely charge size used on Flight PA103, calculations suggested that the initial 
Mach stem shock wave pressure close to the region of Mach stem formation (i.e. the shock wave face-on pressure, 
acting at right angles to the skin), was likely to be more than twice that of the incident shock wave, with a velocity of 
propagation perhaps 25 per cent greater. However, the Mach stem out-of-plane pressure, i.e. the pressure felt by the 
reflecting surface where the Mach stem touches it, would have been relatively low and insufficient to shatter the skin 
material. Therefore, provided that the charge had sufficient energy to produce skin shatter within the conical central 
region where no Mach stems form, the size of the shattered region would be a function mainly of charge standoff 
distance, and charge weight would have had little influence. Consequently, it was possible to calculate the charge 
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standoff distance required to produce a given size of shattered skin from geometric considerations alone. On this basis, 
a charge standoff distance of approximately 25 to 27 inches would have resulted in a shattered region of some 18 to 20 
inches in diameter, broadly comparable to the size of the shattered region evident on the three-dimensional wreckage 
reconstruction. 


19.6.7 While the analytical method makes no allowance for the effect of the IED casing, or any other baggage or 
container structure interposed between the charge and the fuselage skin, the presence of such a barrier would have 
tended to absorb energy rather than redirect the transmitted shock wave; therefore its presence would have been more 
critical in terms of charge size than of position. 


19.6.8 Certainly, the standoff distance predicted by this method was strikingly similar to the figure of 25 inches 
derived independently from the container and fuselage reconstructions. 
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Figure Ill-19-21. Mach stem shock wave analysis 


Chapter 20 


INVESTIGATING SYSTEM DESIGN ISSUES 


20.1 SCOPE AND PURPOSE 
This chapter will introduce the investigator to the relationship between system design and safety. It will briefly discuss 
parts of the safety assurance process as described in SAE ARP 4754 and the safety analysis process of SAE ARP 4761. 


It will briefly address the role of testing in the design verification process. The chapter will then suggest how an 
investigator might review the safety assurance process to evaluate the design. 


20.2 THE DESIGN ASSURANCE PROCESS 

20.2.1 The complexity of modern aircraft systems is such that a deliberate, systematic and well-documented 
approach to design is absolutely essential to ensure adequate levels of safety. The international aviation community has 
largely adopted the SAE Aerospace Recommended Practice, ARP4754, “Certification Considerations for Highly 
Integrated or Complex Aircraft Systems” as the standard for new certifications. This process has developed from similar 
processes used by the major aircraft manufacturers to meet certification requirements. The generic steps in this design 
process are: 

1. Identify aircraft-level functions, functional requirements and functional interfaces. 

2. Evaluate functional failure consequences and implications. 

3. Allocate functions to systems. 

4. Design system architecture. 

5. Design/build hardware and software. 

6. Integrate hardware and software. 


7. Integrate systems. 


20.2.2 The design activities should be completely integrated with the certification process. This provides an 
overall, systematic approach to ensuring a safety design. 
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20.3 THE CERTIFICATION PROCESS 


20.3.1 The purpose of the certification process for aircraft is to establish that the aircraft and its systems meet the 
applicable airworthiness requirements. The process should include a certification plan which outlines the approach the 
applicant intends to use to demonstrate compliance. The substantiation of compliance is accomplished through the data 
submitted as evidence that the systems and aircraft satisfy the airworthiness requirements. A good description of this 
process is found in SAE ARP4754. The key element in the certification is the Safety Assessment Process. 


20.3.2 In order to better understand this process, some definitions are necessary: 


a) System. A composite at any level of complexity, of personnel, procedures, materials, tools, equipment, 
facilities, and software. The elements of this composite are used together in the intended operational 
or support environment to perform a given task or achieve a specific production, support or mission 
requirement. 


b) Common cause analysis. A generic term encompassing common mode analysis, particular risk 
analysis and zonal safety analysis. These three types of analysis combine to identify individual failure 
modes or external events that can compromise design independencies and result in catastrophic or 
hazardous/severe major failure conditions. Descriptions of these analysis types and the procedures for 
accomplishing them can be found in SAE ARP4761. 


c) Failure condition. A condition with an effect on the aircraft and its occupants, both direct and 
consequential, caused or contributed to by one or more failures, considering relevant adverse 
operation or environmental conditions. A Failure Condition is classified in accordance with the severity 
of effects as defined in FAA Advisory Circular AC 25.1309-1A or JAA AMJ 25-1309. 


d) Failure modes and effects analysis (FMEA). An FMEA is a systematic bottom-up method of identifying 
the failure modes of a system, item or function and determining the effects on the next higher level. 
Typically, an FMEA is used to address failure effects from single failures. 


e) Fault tree analysis (FTA). The FTA is a top-down used to evaluate single failures and combinations of 
failures that could result in a specified failure condition. An FTA can be qualitative or quantitative. 


f) | Functional hazard analysis (FHA). A systematic, comprehensive examination of functions to identify 
and classify failure conditions of those functions according to their severity. 


g) Hazard. A condition or an object with the potential to cause injuries to personnel, damage to 
equipment or structures, loss of material, or reduction of ability to perform a prescribed function. 


h) Safety risk. Foreseeable or projected safety consequence or outcome from an existing hazard or 
situation. 


i) Accident. An occurrence associated with the operation of an aircraft which, in the case of a manned 
aircraft, takes place between the time any person boards the aircraft with the intention of flight until 
such time as all such persons have disembarked, or in the case of an unmanned aircraft, takes place 
between the time the aircraft is ready to move with the purpose of flight until such time as it comes to 
rest at the end of the flight and the primary propulsion system is shut down, in which: 
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a) 


a person is fatally or seriously injured as a result of: 


— being in the aircraft, or 

— direct contact with any part of the aircraft, including parts which have become detached from 
the aircraft, or 

— direct exposure to jet blast, 


except when the injuries are from natural causes, self-inflicted or inflicted by other persons, or 
when the injuries are to stowaways hiding outside the areas normally available to the passengers 
and crew; or 


the aircraft sustains damage or structural failure which: 


— adversely affects the structural strength, performance or flight characteristics of the aircraft, 
and 
— would normally require major repair or replacement of the affected component, 


except for engine failure or damage, when the damage is limited to a single engine (including its 
cowlings or accessories), to propellers, wing tips, antennas, probes, vanes, tires, brakes, wheels, 
fairings, panels, landing gear doors, windscreens, the aircraft skin (such as small dents or 
puncture holes), or for minor damages to main rotor blades, tail rotor blades, landing gear, and 
those resulting from hail or bird strike (including holes in the radome); or 


the aircraft is missing or is completely inaccessible. 


Design defect. System does not meet design specification or standard. 


Manufacturing defect. System does not meet quality specification or standard. 


System safety. The application of engineering and management principles, criteria, and techniques to 
optimize all aspects of safety within the constraints of operational effectiveness, time, and cost 
throughout all phases of the system life cycle. 


20.4 THE SAFETY ASSESSMENT PROCESS 


20.4.1 The decisions made during the design of an aircraft can have significant effects upon accident causation. 
Airworthiness requirements for certification of commercial aircraft are, for the most part, intended to ensure adequate 
safety for passengers. This is accomplished by specifying the required maximum probability for occurrence of undesired 
events that have catastrophic or hazardous consequences. The concept is that the design of the aircraft must 
adequately control these events. The process revolves around a series of analyses: Functional Hazard Assessment, 
Preliminary System Safety Assessment, System Safety Assessment and Common Cause Analysis. Each of the steps in 
the development cycle focuses on a specific area and the analyses associated with that area support the design 


development. 
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20.4.2 Looking at Table Ill-20-1, one sees that during the Concept Development phase, an Aircraft level 
Functional Hazard Analysis (FHA) is completed. The FHA considers the required functions and evaluates the hazards 
inherent in these functions for the effects on the aircraft and then assigns a classification to that hazard. This process is 
repeated at the major system level for each system as the Preliminary Design takes shape. The purpose of the FHAs is 
to drive the design decisions to reduce the risk of hazards to a level acceptable for certification as defined in the 
applicable directives. The FMEAS and FTAs which are conducted during the Detailed Design and Design Validation & 
Verification phases are used to confirm that the design approach does in fact meet the requirements for certification. 
Finally, the Common Cause Analysis process identifies failures and events that compromise the independency of 
systems and design that can therefore result in unacceptable risk to the aircraft or occupants. 


20.4.3 This process, done properly, establishes the safety of the aircraft and systems. It documents the rationale 
for design decisions regarding safety. Therefore, these analyses should be of considerable interest to the accident 
investigator. The primary reason is that the analyses described here are completed before the system is operational. 
This means that the designers and analysts must make some assumptions about the operational environment. 


20.4.4 Usually these assumptions are accurate, but occasionally unanticipated conditions in the operational world 
compromise the design resulting in an accident or serious incident. Even if the design meets the criteria for catastrophic 
events of 1x 10°, this does not mean that the event cannot happen. As an example, the post-event calculated 
probability for the series of failures that resulted in the 1989 crash of UA 232, a DC-10, in Sioux City, Nebraska was 
approximately 1 x 10°'°. Six independent events combined to cause the ultimate loss of hydraulics and thus all flight 
control. 


20.4.5 Modifications to the aircraft systems or to the operational environment of the aircraft can make the earlier 
analyses inaccurate. Operational modifications are a common factor in military aviation. Often, by the time a system is 
fielded, operational requirements have changed and the aircraft must be employed in a new role. Even in the civilian 
world this can happen. A recent example is the use of former military aircraft as fire fighting aerial tankers. This new use 
imposed unanticipated stresses on the aircraft and has resulted in a significant number of structural failures and fatal 
accidents. 


20.4.6 Finally, the analyses assume a fully functional system operated within the specified design life. Many 
aircraft currently being operated have far exceeded the original design life. This is the crux of the entire aging aircraft 
dilemma. It has affected not only structural concerns but also other systems as well. There is evidence that aging wiring 
may have been a factor in the 1996 loss of TWA Flight 800, a Boeing 747. 


20.4.7 As stated earlier, the safety assessment process is conducted to evaluate the design decisions for an 
aircraft to meet the criteria for an adequate level of safety. By identifying the hazards inherent in a design and then 
controlling the probability of an accident occurring from the hazard or reducing the severity of the effect of an accident, 
the designer can meet the specified levels of safety as stated in FAA and European communities in both the FARs and 
JARs. Each of the analyses has a specific function to perform in the process. 
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Table III-20-1. 


The safety assessment processes 


A typical development cycle 





Concept Development 


Preliminary Design 


Detailed Design Design Validation & 
































Verification 
Aircraft Functions System Functions Detailed Functions Tests 
Aircraft Architecture System Architecture Detailed Architecture Analysis 
Aircraft Requirements System Requirements Detailed Requirements 
Aircraft FHA System FHA 
- Functions - Functions 
- Hazards - Hazards 
- Effects - Effects 
- Classifications - Classifications 
PSSAs SSAs 
System System FTAs 
Aircraft FTAs System FTAs FMEAs - Quantitative 
- Qualitative - Qualitative FMES - Failure Rates 
- System Budgets - System Budgets 
- Intersystem 
Dependencies 









































CCAs 





Particular Risk Analyses 




















Common Mode Analyses 














Zonal Safety Analyses 




















20.4.8 The measure for controlling undesired events or hazards is a probability/risk matrix which establishes the 
maximum allowable probability of an event based upon the estimated effect. Table II|-20-2 illustrates this concept as 
defined in the FARs and JARs. 
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Table Ill-20-2. Probability/effect risk matrix 
Probability 
(Quantitative) 1.0 10° 10° 107 10° 
Probability FAR Probable Improbable Extremely 
(Descriptive) improbable 
JAR Frequent Reasonably Remote Extremely remote Extremely 
probable improbable 
Failure Condition | FAR Minor Major Catastrophic 
Severity 
Classification JAR Minor Major Hazardous Catastrophic 
Effect on aircraft |FAR  |- Does not significantly reduce |— Reduce capability of airplane or crew with Conditions which 
occupants airplane safety (Slight adverse operating conditions prevent 
decrease in safety margins) — Significant reduction in safety margins continued safe 
— Crew actions well within — Significant increase in crew workload flight and landing 
capabilities (Slight increase in 
crew workload) Severe cases: 
— Some inconvenience to — Large reductions in safety margins 
occupants — Higher workload or physical distress on crew ~ 
can’t be relied upon to perform tasks 
accurately 
— Adverse effects on occupants 
JAR Nuisance — Operating — Significant reduction |— Large reduction in — Multiple 
Limitations in safety margins safety margins deaths, usually 
— Emergency |- Difficult for crews to |— Crew extended with loss of 
Procedures cope with adverse because of workload aircraft 




















conditions 
— Passenger injuries 





or environmental 
conditions 

— Serious or fatal injury 
to small number of 
occupants 








20.5 DESIGN SAFETY 


Once the risk level for an identified hazard is established a corrective action must be taken if the risk level does not meet 
certification criteria. The corrective action or design approach is based upon what is called the Safety Order of 
Precedence. It provides guidance to help drive design decisions. There are four priorities in the Safety Order of 
Precedence, ranked 1 to 4 in level of desirability. These four approaches are not mutually exclusive. In fact, most 
solutions employ a combination of two or more of these to reach an acceptable level of safety. These recommended 
actions are described in Table II|-20-3. 
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Table Ill-20-3. Safety order of precedence for design 











Description Priority | Definition 

Design for 1 Design to eliminate risks. If the identified risk cannot be eliminated, reduce it 
minimum risk to an acceptable level through design selection. 

Incorporate 2 If identified risks cannot be eliminated through design selection, reduce risk 
safety devices via the use of fixed, automatic, or other safety design features or devices. 


Provisions shall be made for periodic functional checks of safety devices. 





Provide warning 3 When neither design nor safety devices can effectively eliminate identified 
devices risks or adequately reduce risk, devices shall be used to detect the 
condition and to produce an adequate warning signal. Warning signals and 
their application shall be designed to minimize the likelihood of 
inappropriate human reaction and response. Warning signals and placards 
shall be provided to alert operational and support personnel of such risks as 
exposure to high voltage or heavy objects. 





Develop 4 Where it is impractical to eliminate risks through design selection or specific 
procedures and safety and warning devices, procedures and training are used. However, 
training concurrence of authority is usually required when procedures and training 


are applied to reduce risks of catastrophic, major or critical severity. 

















20.6 RELIABILITY VS SYSTEM SAFETY 


20.6.1 There is a fundamental and philosophical difference between the way reliability and safety engineers look 
at failures. The reliability view is very “hardware-oriented”. This is emphasized by the definition of reliability from a 
popular text on Reliability Engineering. “The engineering definition for reliability (on a non-repaired item) is ‘The 
probability that an item will perform a required function without failure under stated conditions for a stated period of 
time.”" Safety, on the other hand, looks at events that have potential catastrophic effects upon the system as a whole or 
more especially, the people involved. The failure of a component or item is significant only in its effect upon the accident 
potential of the system as a whole. A case in point is the Air Transat Flight 236 incident of an Airbus 330 in 2001 where 
a fuel system component failure resulted in a dual engine failure of an ETOPS aircraft and an 18-mile over-water glide to 
a landing. This can be evaluated by comparing the process for a Failure Modes and Effects Analysis (FMEA) (a 
reliability tool) and a Subsystem Hazard Analysis (SSHA) (a system safety tool). 


20.6.2 The FMEA is a bottom-up analysis that evaluates the failure of every part in a component, item, subsystem 
or system in every possible failure mode and operational condition. It is a hardware oriented analysis that focuses on 
single failures. Human error is considered but it must still be a single failure since the analysis does not lend itself to 
combinations of failures. The real problem with the FMEA, however, is that it must consider ALL failures in a system. 
Therefore, significant failures may become lost in the sheer volume of data available. And, the FMEA looks inside the 
system and does not treat external events very effectively. The SSHA, on the other hand, focuses on safety 
requirements rather than reliability standards. While much of the process is similar the focus is very different and failures 
are only considered relevant in light of their impact on safety. In general, SSHAs are accomplished primarily on military 
programmes. The civilian programmes, particularly aviation programmes, employ a process similar to that shown in 
Table III-20-1. 





1. O’Connor, Patrick D.T., Practical Reliability Engineering, 2” ed., John Wiley & Sons, New York, 1985, page 5. 
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20.7 SYSTEM SAFETY AND THE ACCIDENT INVESTIGATOR 


20.7.1 It is unfortunate, but there has traditionally been little or no link between the accident investigator and the 
system safety analyst. It is true that investigators often identify design or systems issues that are related to accident 
causation and many safety recommendations do address design improvements. However, seldom does the 
investigation look at how the failures that resulted in the accident were treated in the analyses conducted during the 
design of the aircraft. In a properly conducted safety assessment process during the design of an aircraft, all credible 
hazards would be identified and classified. While this is true in theory, in practice the results are not ideal. As discussed 
earlier, sometimes the assumptions made by the engineers and analysts during the design phase do not accurately 
reflect operational realities for one reason or another. Then there is the problem that all design is a compromise, a 
balance between the need for speed, load-carrying capability, range or passenger comfort and safety. Sometimes these 
compromises are not optimal. A case in point is the 1998 Swissair Flight 111 accident involving an MD-11 aircraft off 
Nova Scotia. It appears from the evidence that the passenger entertainment system was in part involved in the fire that 
the aircraft experienced. Sometimes the design decisions are the result of lack of technology. There are several 
examples of such problems in the early history of modern aviation. Recently, a new problem has started to emerge. With 
the introduction of advanced avionics and computer-based fly-by-wire systems, safety analysis has not been able to 
keep pace with technology. A software system cannot be evaluated like a traditional hardware system. 


20.7.2 The key reason for investigating accidents is to prevent future similar accidents from occurring. One aspect 
of this should be to determine why the failures that resulted in the accident were not properly controlled in the design. 
When design issues are believed to be causal or contributing to an accident the investigator-in-charge should ensure 
that an expert in the field of aircraft design participated in the investigation. 

20.7.3 A part of the investigation process should be to obtain and evaluate the analyses submitted as part of the 
certification process. In particular the investigator should be looking for the hazards or failures that contributed to the 
accident. The investigation should include an examination of the analysis and the recommendations for corrective action. 
The question here is why didn’t the corrective action chosen prevent the failure? Discovering the answer to this may be 
a significant step toward accident prevention. The investigator should look into whether any training or procedures were 
specified as part of the corrective action and then whether those recommendations were carried through in the training 
plans and procedural manuals. 

20.7.4 In summary, the investigator should attempt to answer the following questions: 


a) How was safety designed in? 


1) How did the design team address the commonly recognized hazards and how does the design 
architecture meet the criteria of the FAR/JAR specifications? 


b) Ask for the analyses that identified the hazards and the design corrective actions. 
1) Were the classifications for the identified hazards correctly assessed? 
2) Was training included for the procedural corrective actions? 

c) Specifically look at the design in light of the accident being investigated? 
1) What corrective actions should be recommended in light of the accident? 


d) Identify the specifications and design criteria that apply. Were they followed? 
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e) Was the acceptable risk level inappropriate? 


f) Has the mission or usage changed without a revised safety assessment? 


20.8 INVESTIGATING SYSTEMS 


20.8.1 First, investigate the operation at the time of the failure. Did the component or system exceed normal 
operating parameters in terms of time in service, range of motion, speed, rating or capacity? If so, the failure of the 
system or item is to be expected. However, the question should be was the result of this failure properly identified in the 
safety assessment process? Another case in point is the 2001 accident related to the failure of the vertical tail of 
American Airlines Flight 587, an Airbus 300 aircraft, where the condition of operating in the wake of a preceding aircraft, 
coupled with an aggressive pilot input exceeded the structural integrity of the airframe. 


20.8.2 On the other hand, if the item or system did not exceed its stated normal operating parameters, a different 
series of questions must be answered. In this case the investigator must determine whether the design was adequate for 
the current operation. Here again, go to the original design specification for the information and compare it to actual 
operating experience. Next evaluate the maintenance for the system. Do the specifications fulfill the real requirements 
for the operation? Finally, if an unexpected failure occurs, the investigator should evaluate the inspection intervals for the 
system or component. During initial design development, many inspection intervals are established based upon 
calculated or predicted failure rates or Mean Time Between Failure (MTBF). Often these are very pessimistic estimates. 
As operational data becomes available these intervals can be adjusted to reflect the better “real-time” data. Usually this 
leads to a lengthening of the inspection or replacement intervals. This is fine as long as the system maintains a constant 
MTBF. However, as a system ages, the MTBF often begins to shrink. This means that the established inspection interval 
is no longer adequate to prevent failures from occurring. Once again the investigator must compare predicted values 
with actual experience to determine the proper corrective action. 


20.9 TEST AND EVALUATION AND INVESTIGATION 


20.9.1 The purpose of a test programme is to provide proof of the theoretical calculations concerning design, 
reliability and safety. The types of testing usually associated with a design are: 


a) Design development testing. Used to validate that the design meets reliability or safety requirements 
or to highlight areas for improvement; 


b) Demonstration and qualification testing. Has the purpose of demonstrating compliance with design 
requirements or to determine if a particular design should be considered for its intended application; 


c) Acceptance testing. Determines whether a part, assembly, or end item should be accepted or rejected 
for use; and 


d) Operational testing. Designed to verify analyses performed during the project and to provide data on 
modifications of operational procedures and policies as they affect reliability, maintainability and 
safety. 


20.9.2 For all of these test types the goal is to validate or improve the design, not specifically safety validation. 
Although such safety testing can be done, testing is a major expense in any programme, and so such specialized tests 
are often limited to addressing specific hazards. The key benefit to safety of most testing is the validation of design 
hazard control measures and, if necessary, the identification of unexpected hazards or reactions to design measures. 
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20.9.3 A comprehensive test and evaluation programme produces a number of reports and much data that could 
be useful to an investigator. These include test analysis reports, lists of identified hazards, and lists of required safety 
data among others. These can be sources of valuable information for the accident investigator. One of the things an 
investigator should look for is the interaction between the various analyses, the design and the test programme. A key 
step in the design process is verification that the design does, in fact, meet the safety criteria. This may be done by 
analysis, inspection, or by test. If the accident investigator uncovers indications that the design criteria may not have 
been met, it is essential that the test programme be evaluated to determine if this is true and why. 


20.9.4 There can be no doubt about the importance of a complete, integrated, planned, documented, and 
vigorously executed test programme. Key to this is a well thought-out and executed test procedure. The higher the 
required level of reliability or, more importantly, safety, the more critical the quality of the test procedure. 


20.9.5 Test procedures are designed to describe and control three distinct areas of testing. The investigator, in 
evaluating a test programme, should focus on how well the procedure met its objectives. 


20.9.6 The first area is test equipment calibration. This calibration must be against standards that are traceable to 
internationally recognized standards setting agencies. The investigator should verify that the calibration was done at the 
test leads. The calibration should include the input as well as the measurement aspects of the equipment and also that 
the environmental conditions reflect the planned environment. 


20.9.7 Closely allied with calibration is the second area, proofing the test equipment. This is a formal 
demonstration that the test equipment design and configuration for this specified test does perform its intended function 
when connected to the test hardware. Proofing is also used to uncover unexpected anomalies in the equipment or 
conditions. For the investigator the record of accomplishment of such proofing, particularly for new test equipment, is 
important. 


20.9.8 The third area of procedural control is the test programme itself. Not only should this programme describe, 
in detail, all the adjustments, hook-ups and switch sequences necessary for the test, but it should also include detailed 
data sheets that clearly record all the pertinent data required to successfully complete the test. 


20.9.9 There is one other key benefit of testing for the designer and the accident investigator. This is the detection 
of unspecified, undesirable operations or indications. The problem is that most specifications are written to describe 
what a system must do but, other than a few obvious critical events they seldom specify what a system must not do. 
However, if a test plan is well written, it will require the documentation of unusual or unspecified operations or indications, 
especially adverse ones. One of the things an accident investigator could ask therefore is whether the test programme 
discovered any indication of the characteristics or operational effects noted in the accident sequence. Then the follow-on 
question should be if such adverse effects were discovered, what design action, if any, was taken to control the effect. 


20.10 SUMMARY 


Design failures are a relatively small part of the overall accident history in modern aviation. This is due in large part to 
the emphasis of the aviation community throughout the years to ensure a safe design. However, mistakes, oversights, 
misuse and failures do occur and when a design issue appears to be part of the accident sequence, the investigator 
must go back to the design process to fully understand and then make recommendations to correct those deficiencies. 
An expert in the field of aircraft design should be part of the investigation team when design issues are believed to be 
causal or contributing to an accident or serious incident. 


— END — 
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